Re: Strange Pix behavior.

[Martin Mačok <martin.macok () underground cz>]

On Thu, Jun 16, 2005 at 01:00:20AM -0700, Jim MacLeod wrote:

> It's invalid to ACK a RST, and would provoke yet another RST.

No, it's not invalid (in some scenarious). Yes, it would provoke yet
another RST.

ACKing RST is one of the countermeasures against recently debated TCP
weakness (sequence number approximation bug) where the attacker spoofs
RST packets and breaks (usually long-lived) established connections
(like BGP).

IIRC you can ACK the RST packet when it does not fit exactly into TCP
sequence but somewhere inside the (TCP) window. The provoked next RST
reply should fit exactly into sequence so this time you know the RST
was not spoofed.

(Just a side-note, sorry for the noise)

Martin Mačok
ICT Security Consultant
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards