North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: TCP RST attack (the cause of all that MD5-o-rama)

  • From: Iljitsch van Beijnum
  • Date: Tue Apr 20 17:29:47 2004

On 20-apr-04, at 21:40, Patrick W.Gilmore wrote:

What is a typical receive window on a router? I have been told (have not confirmed) it was about 14 bits.
Cisco routers have a command that will show you this number. It's generally just under 16k. Unfortunately, some looking glasses allow anyone to execute this command...

(Someone check my math. :)
I think your math computes. I was worried for a moment that TCP might be tricked into emitting a packet when you hit the right port combo but the wrong sequence number. It does, and even helps out by sending back the right sequence number. But of course this packet goes to the real correspondent so this shouldn't help the attacker.