Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

a recent security review on a customers webserver yielded the following results:

"[...] The system under test is using incremental ip ids. This means that every outgoing ip packet has an incrementing id number which can be used for stealth load analysis or for so called idle scans against third party systems. [...]"

A hping of the system is showing the incrementing id numbers:

$ sudo hping3 -c 3 --fast -p 80 -S
HPING (tun0 S set, 40 headers + 0 data bytes
len=44 ttl=122 DF id=14360 sport=80 flags=SA seq=0 win=8192 rtt=802.2 ms
len=44 ttl=122 DF id=14361 sport=80 flags=SA seq=1 win=8192 rtt=807.1 ms
len=44 ttl=122 DF id=14362 sport=80 flags=SA seq=2 win=8192 rtt=801.6 ms

The system is a Windows Server 2003 SP2 (respectively multiple loadbalanced servers).
It may not be suitable as a zombie host in an idle scan as it is quite the opposite of idle. But if we can change the behaviour we want to change it.

I can't find any documentation about the IPID sequence generation algorithm in the Windows TCP/IP stack, e.g. if it's only incrementing by host or global or if the behaviour changed with later versions of Windows.
Just this one Patch Available to Improve TCP Initial Sequence Number Randomness

Can anyone point me to documentation about what version of windows is using which IPID sequence generation algorithm?
Are there any options to change the IPID generation?

share|improve this question

1 Answer 1 indicates that it does already make random numbers. You say that this is actually "multiple loadbalanced servers". So what IP are you pinging? That would be want you want to look at.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.