Full Disclosure mailing list archives
Re: Crafted SYN Packets...
From: nocfed <nocfed () gmail com>
Date: Tue, 13 Nov 2007 19:27:20 -0600
Google for ephemeral port tcp syn On Nov 13, 2007 5:43 PM, Dean Pierce <piercede () pdx edu> wrote:
Simon Smith wrote:Kelly, SYN packets and ports do not correlate. And yes, SYN is TCP. Youshouldread up on TCP/IP etc so that you understand protocols before posting to mailing lists.Maybe then you could explain how it works :-) From what I understand, the RFC doesn't really specify how source ports should be generated for new TCP sessions (Please someone correct me if I'm wrong, I am not intimately familiar with that particular set of RFCs). On my linux system I have currently have access to, the numbers I am getting seem pretty random (59101, 49607, 40343, 54786, 38335, ...) while the windows xp machine I am on seems to be rather sequential (12050, 12065, 10293, ...). Also, google claims that source ports have been used to identify worms etc where the source ports have been hard coded into the packet engine. Hopefully someone more familiar with the field responds :-) - DEAN _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Crafted SYN Packets... Kelly Robinson (Nov 13)
- Re: Crafted SYN Packets... Simon Smith (Nov 13)
- Re: Crafted SYN Packets... Paul Schmehl (Nov 13)
- Re: Crafted SYN Packets... Dean Pierce (Nov 13)
- Re: Crafted SYN Packets... nocfed (Nov 13)
- Re: Crafted SYN Packets... Thierry Zoller (Nov 13)
- Re: Crafted SYN Packets... Simon Smith (Nov 13)