Subject: Question on initial sequence numbers

From: [email-masked]
Date: Mon, 4 Jan 1999 09:24:42 -0800

The following question came to me, but since it seems highly relevant
to this list, I am forwarding it (with permission).  In any replies,
please include the CC: to Richard Berke, who is not on this list.

Bob Braden

----- Begin Included Message -----

---

From: [email-masked] (Alan Cox)
Date: Mon, 4 Jan 1999 19:19:16 +0000 (GMT)

It seems somewhat dangerous and unneccessary. Random sequence numbering causing
overlaps can cause corruption and fights. Its very rare - and there are actual
protocol bugs in RST (Ian Heavens draft) which could do this too and are
also extremely rare.

What most vendors Im aware of do is to compute the sequence space as

	counter+hash_function(src,dst{, port, port})

Where the hash function is in itself an at least semi secure hash. That means
that for any given connection space the sequence numbers follow rfc rules
but that seeing one connection space doesn't let you identify another
connection space properties unless the hash function is flawed.

This covers the same space as "true" random numbers but doesn't break the
specifications. 

Neither scheme is terribly effective if the attacker has snmp access to any
router close to either end.

Alan