Subject: [tcpm] tcpsecure: what about FIN attacks?

From: "Charlet, Ricky" <[email-masked]>
Date: Thu, 20 May 2004 10:28:07 -0700

Howdy,
	
	draft-ietf-tcpm-tcpsecure-00.txt does not provide a discussion
of defence against blind attackers sending FIN packets with good guesses
for sequence numbers. Are FIN packets not a concern here? If not, why
not?

---
Ricky Charlet
[email-masked]
USA 831.466.4968

-----------------------------------------------------------
Unless otherwise expressly stated, this message does not
create or vary any contractual relationship between you and 
ARC International.  The contents of this e-mail may be 
confidential and if you have received it in error, please 
delete it from your system, destroy any hard copies and 
telephone the above number.  Incoming emails to ARC may be 
subject to monitoring other than by the addressee.

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: Don Lewis <[email-masked]>
Date: Thu, 20 May 2004 16:00:28 -0700 (PDT)

> for sequence numbers. Are FIN packets not a concern here? If not, why

That is essentially the same as a blind data injection attack.  Checking
the ACK value to prevent data from being injected would also prevent a
FIN from being injected.