RE: [ILUG] nmap

From: Paul O'Neil (poneil at domain dbiassociates.net)
Date: Fri 05 Jul 2002 - 13:36:41 IST

• Next message: Philip Reynolds: "Re: [ILUG] gdict like applet for windowmaker..."
• Previous message: Ronan Waide: "Re: [ILUG] how does a gcc version effect the kernel build ?"
• In reply to: Vincent Cunniffe: "Re: [ILUG] nmap"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
• Mail actions: [ respond to this message ] [ mail a new topic ]

-----Original Message-----
From: ilug-admin at domain linux.ie [mailto:ilug-admin at domain linux.ie]On Behalf Of
Vincent Cunniffe
Sent: Friday, July 05, 2002 5:24 AM
To: ilug at domain linux.ie
Subject: Re: [ILUG] nmap

Paul O'Neil wrote:
> I posted this question to a security news group and got back the answer
"its
> time for a kernel upgrade". I'm not sure what that meant since I'm using
the
> latest. Perhaps a recompile with certain options is in order I dont know,
> but the question was this. After running NMAP against an iptables linux
box
> and a cisco router firewall feature set one difference in the results I
> noted was that for the Linux box it displayed this at the end of the
results
>
> Remote operating system guess: Linux Kernel 2.4.0 - 2.4.18 (X86)
> Uptime 0.523 days (since Wed Jul 3 16:03:12 2002)
> TCP Sequence Prediction: Class=random positive increments
> Difficulty=642160 (Good luck!)
> IPID Sequence Generation: All zeros
>
> The "GOOD LUCK" comment bother me. For the Cisco router it said "medium"
> instead of good luck. What exactly does this measurement mean?

It means good luck to you in trying to craft a TCP sequence prediction
attack by guessing the next number in the series. Some systems have
stupid generation sequences which can be tuned into and then predicted
if you sniff enough packets. This one doesn't.

Regards,

Vin

--
Irish Linux Users' Group: ilug at domain linux.ie
http://www.linux.ie/mailman/listinfo/ilug for (un)subscription information.
List maintainer: listmaster at domain linux.ie
Oh wow, I was reading it wrong I thought it implied negatively about
protection. So the iptables Linux box is better protected than the Cisco for
that specific attack then? The security newsgroup person says the "Kernel
upgrade" is needed to remedy the IPID Sequence Generation being All zeros.
And that kernel 2.4.5 should have that fix.

• Next message: Philip Reynolds: "Re: [ILUG] gdict like applet for windowmaker..."
• Previous message: Ronan Waide: "Re: [ILUG] how does a gcc version effect the kernel build ?"
• In reply to: Vincent Cunniffe: "Re: [ILUG] nmap"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
• Mail actions: [ respond to this message ] [ mail a new topic ]

This archive was generated by hypermail 2.1.6 : Thu 06 Feb 2003 - 13:17:41 GMT