TCP RST attack (the cause of all that MD5-o-rama)
Iljitsch van Beijnum
iljitsch at muada.com
Tue Apr 20 21:16:37 UTC 2004
On 20-apr-04, at 21:40, Patrick W.Gilmore wrote:
> What is a typical receive window on a router? I have been told (have
> not confirmed) it was about 14 bits.
Cisco routers have a command that will show you this number. It's
generally just under 16k. Unfortunately, some looking glasses allow
anyone to execute this command...
> (Someone check my math. :)
I think your math computes. I was worried for a moment that TCP might
be tricked into emitting a packet when you hit the right port combo but
the wrong sequence number. It does, and even helps out by sending back
the right sequence number. But of course this packet goes to the real
correspondent so this shouldn't help the attacker.
More information about the NANOG
mailing list