IDS mailing list archives
Re: TCP ACK/RST packets with data in the Reset Cause
From: Mike Frantzen <frantzen () nfr com>
Date: Tue, 10 Jan 2006 22:37:16 -0500
Has anyone ever seen TCP RST packets being sent from clients to web server with a "Reset Cause" containing the HTML that was in the packet that they are responding to? For example a browser client is getting a 404 error returned from my webserver but right after this I am seeing a CP ACK/RST packet from the client with the 404 HTML in the packet. When I look at the packet in Ethereal it shows the HTML in a field called "Reset cause". These packets are causing my IDS to go nuts.
It was an old HP/UX (I think it was HP/UX anyway) trick to stick the reason for the reset into the packet itself. That is why ethereal is calling it that. The "reset clause" was picked up for awhile in some older firewalls but it has really been forgotten about in anything new. Now the client is probably just inverting the 404 packet into a reset. It is an old TCP stack trick to send a reset without having to allocate a new packet. Instead you just modify the packet in place to turn it into a reset: swap the sequence and the ACK numbers, the ports and the IP addresses, then you set TH_RST flag and finally fixup the checksums. Send the packet back through the routing table or flip the MAC addrs and send it back out the incoming interface. You would have to provide much more detail about the client to guess at why it is sending a reset. My blind guess is that the client is a http scanner/fingerprinter/ping that uses raw sockets instead of the host TCP stack. It is tearing down the connection once it got the response back. Should the IDS be looking at the data in the ACK/RST packet? Unfortunately yes unless it has a fingerprint of the server and knows how the TCP stack is going to handle the excess data. It could be used as a vector to attack the logging subsystem. Pardon any misspelling, I'm exhausted. .mike frantzen@(nfr.com | cvs.openbsd.org | w4g.org) PGP: CC A4 E2 E8 0C F8 42 F0 BC 26 85 5B 6F 9E ED 28 ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ------------------------------------------------------------------------
Current thread:
- TCP ACK/RST packets with data in the Reset Cause Mike Gibson (Jan 10)
- Re: TCP ACK/RST packets with data in the Reset Cause Mike Frantzen (Jan 11)
- <Possible follow-ups>
- RE: TCP ACK/RST packets with data in the Reset Cause Palmer, Paul (ISSAtlanta) (Jan 11)