1

a recent security review on a customers webserver yielded the following results:

"[...] The system under test is using incremental ip ids. This means that every outgoing ip packet has an incrementing id number which can be used for stealth load analysis or for so called idle scans against third party systems. [...]"

A hping of the system is showing the incrementing id numbers:

$ sudo hping3 -c 3 --fast -p 80 -S xxx.xxx.xxx.xxx
HPING xxx.xxx.xxx.xxx (tun0 xxx.xxx.xxx.xxx): S set, 40 headers + 0 data bytes
len=44 ip=xxx.xxx.xxx.xxx ttl=122 DF id=14360 sport=80 flags=SA seq=0 win=8192 rtt=802.2 ms
len=44 ip=xxx.xxx.xxx.xxx ttl=122 DF id=14361 sport=80 flags=SA seq=1 win=8192 rtt=807.1 ms
len=44 ip=xxx.xxx.xxx.xxx ttl=122 DF id=14362 sport=80 flags=SA seq=2 win=8192 rtt=801.6 ms

The system is a Windows Server 2003 SP2 (respectively multiple loadbalanced servers).
It may not be suitable as a zombie host in an idle scan as it is quite the opposite of idle. But if we can change the behaviour we want to change it.

I can't find any documentation about the IPID sequence generation algorithm in the Windows TCP/IP stack, e.g. if it's only incrementing by host or global or if the behaviour changed with later versions of Windows.
Just this one Patch Available to Improve TCP Initial Sequence Number Randomness

Can anyone point me to documentation about what version of windows is using which IPID sequence generation algorithm?
Are there any options to change the IPID generation?

1 Answer 1

0

http://msdn.microsoft.com/en-us/library/ms819768.aspx indicates that it does already make random numbers. You say that this is actually "multiple loadbalanced servers". So what IP are you pinging? That would be want you want to look at.

1
  • MSDN link is dead
    – RedShift
    Feb 4, 2021 at 13:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .