Re: IP Spoofing.

["Paul D. Robertson" <proberts () clark net>]

On Tue, 28 Sep 1999, Randy Witlicki wrote:

>   In a prudent setup with both cryptographically strong initial
> TCP sequence numbers (you don't need OpenBSD here, but it helps), and
> a good security perimeter, you should be immune from the "classic" attack.

Which doesn't make you necessarily immune from spoofing attacks, nor even 
necessarily from blind attacks.  Don't forget that you can spoof UDP as well.

>   So, the original poster's boss may be correct, if he is refering to
> blind spoofing and he has a strong OS with prudent perimeter security.

And strong applications, and no connections inititated with hosts that 
aren't strong or have strong applications, and the potential attackers can't 
sniff a packet on a compromised host or network, and they don't just happen 
to get a sequence number that's close enough to a guess to flood back a 
response...

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts () clark net      which may have no basis whatsoever in fact."
                                                                     PSB#9280