a recent security review on a customers webserver yielded the following results:
"[...] The system under test is using incremental ip ids. This means that every outgoing ip packet has an incrementing id number which can be used for stealth load analysis or for so called idle scans against third party systems. [...]"
A hping of the system is showing the incrementing id numbers:
$ sudo hping3 -c 3 --fast -p 80 -S xxx.xxx.xxx.xxx HPING xxx.xxx.xxx.xxx (tun0 xxx.xxx.xxx.xxx): S set, 40 headers + 0 data bytes len=44 ip=xxx.xxx.xxx.xxx ttl=122 DF id=14360 sport=80 flags=SA seq=0 win=8192 rtt=802.2 ms len=44 ip=xxx.xxx.xxx.xxx ttl=122 DF id=14361 sport=80 flags=SA seq=1 win=8192 rtt=807.1 ms len=44 ip=xxx.xxx.xxx.xxx ttl=122 DF id=14362 sport=80 flags=SA seq=2 win=8192 rtt=801.6 ms
The system is a Windows Server 2003 SP2 (respectively multiple loadbalanced servers).
It may not be suitable as a zombie host in an idle scan as it is quite the opposite of idle. But if we can change the behaviour we want to change it.
I can't find any documentation about the IPID sequence generation algorithm in the Windows TCP/IP stack, e.g. if it's only incrementing by host or global or if the behaviour changed with later versions of Windows.
Just this one Patch Available to Improve TCP Initial Sequence Number Randomness
Can anyone point me to documentation about what version of windows is using which IPID sequence generation algorithm?
Are there any options to change the IPID generation?