From: Vincent Cunniffe (vincent at domain cunniffe.net)
Date: Fri 05 Jul 2002 - 13:24:33 IST
Paul O'Neil wrote:
> I posted this question to a security news group and got back the answer "its
> time for a kernel upgrade". I'm not sure what that meant since I'm using the
> latest. Perhaps a recompile with certain options is in order I dont know,
> but the question was this. After running NMAP against an iptables linux box
> and a cisco router firewall feature set one difference in the results I
> noted was that for the Linux box it displayed this at the end of the results
>
> Remote operating system guess: Linux Kernel 2.4.0 - 2.4.18 (X86)
> Uptime 0.523 days (since Wed Jul 3 16:03:12 2002)
> TCP Sequence Prediction: Class=random positive increments
> Difficulty=642160 (Good luck!)
> IPID Sequence Generation: All zeros
>
> The "GOOD LUCK" comment bother me. For the Cisco router it said "medium"
> instead of good luck. What exactly does this measurement mean?
It means good luck to you in trying to craft a TCP sequence prediction
attack by guessing the next number in the series. Some systems have
stupid generation sequences which can be tuned into and then predicted
if you sniff enough packets. This one doesn't.
Regards,
Vin
This archive was generated by hypermail 2.1.6 : Thu 06 Feb 2003 - 13:17:41 GMT