North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: TCP RST attack (the cause of all that MD5-o-rama)

  • From: Peter Galbavy
  • Date: Wed Apr 21 02:55:15 2004 
E.B. Dreger wrote:
> I don't think we're even that far along.  If I'm reading FreeBSD
> 4.9 and NetBSD 1.6.2 source correctly,
>
> /usr/src/sys/netinet/in_pcb.c

Should have stretched as far as OpenBSD then. Same file.

> tells all.

> AFAIK, sequential search is about it.  Try a port number, verify
> that the src/dist ip+port combination is available, then go on to
> the next lport if the guessed one is in use.

As far as I can see - I have never read the code before, just the commit
messages - the OpenBSD version does a circular, random search between high
and low targets.

Peter