[ILUG] nmap

[Paul O'Neil]

-----Original Message-----
From: ilug-admin at linux.ie [mailto:ilug-admin at linux.ie]On Behalf Of
Vincent Cunniffe
Sent: Friday, July 05, 2002 5:24 AM
To: ilug at linux.ie
Subject: Re: [ILUG] nmap


Paul O'Neil wrote:
> I posted this question to a security news group and got back the answer
"its
> time for a kernel upgrade". I'm not sure what that meant since I'm using
the
> latest. Perhaps a recompile with certain options is in order I dont know,
> but the question was this. After running NMAP against an iptables linux
box
> and a cisco router firewall feature set one difference in the results I
> noted was that for the Linux box it displayed this at the end of the
results
>
> Remote operating system guess: Linux Kernel 2.4.0 - 2.4.18 (X86)
> Uptime 0.523 days (since Wed Jul  3 16:03:12 2002)
> TCP Sequence Prediction: Class=random positive increments
>                          Difficulty=642160 (Good luck!)
> IPID Sequence Generation: All zeros
>
> The "GOOD LUCK" comment bother me. For the Cisco router it said "medium"
> instead of good luck. What exactly does this measurement mean?

It means good luck to you in trying to craft a TCP sequence prediction
attack by guessing the next number in the series. Some systems have
stupid generation sequences which can be tuned into and then predicted
if you sniff enough packets. This one doesn't.

Regards,

Vin


--
Irish Linux Users' Group: ilug at linux.ie
http://www.linux.ie/mailman/listinfo/ilug for (un)subscription information.
List maintainer: listmaster at linux.ie



Oh wow, I was reading it wrong I thought it implied negatively about
protection. So the iptables Linux box is better protected than the Cisco for
that specific attack then? The security newsgroup person says the "Kernel
upgrade" is needed to remedy the IPID Sequence Generation being All zeros.
And that kernel 2.4.5 should have that fix.