TCP RST attack (the cause of all that MD5-o-rama)

Iljitsch van Beijnum iljitsch at muada.com
Tue Apr 20 21:16:37 UTC 2004


On 20-apr-04, at 21:40, Patrick W.Gilmore wrote:

> What is a typical receive window on a router?  I have been told (have 
> not confirmed) it was about 14 bits.

Cisco routers have a command that will show you this number. It's 
generally just under 16k. Unfortunately, some looking glasses allow 
anyone to execute this command...

> (Someone check my math. :)

I think your math computes. I was worried for a moment that TCP might 
be tricked into emitting a packet when you hit the right port combo but 
the wrong sequence number. It does, and even helps out by sending back 
the right sequence number. But of course this packet goes to the real 
correspondent so this shouldn't help the attacker.




More information about the NANOG mailing list