Re: TCP/IP ISN Prediction Susceptibility

[Lincoln Yeoh <lyeoh () POP JARING MY>]

That's interesting.

Do you know of any O/S which will/won't do this?

If this method actually works, then one might possibly bypass some sort of
checks in certain firewalls/IDS when targeting vulnerable systems.

Cheerio,
Link.

At 05:26 PM 14-03-2001 +0100, you wrote:
> In particular, you do not have to guess the exact sequence number
> the client is using at the moment; it's enough to have a rough idea of
> it. Assuming you know the upper 16 bits of the sequence number, all it
> takes is inserting some M packets with ISNs N bytes apart (M * N == 65536).
> Unless the TCP window is pathological, the server will queue some of
> these and deliver the data as soon as the "missing" data between the
> current ISN and the guessed ISN arrives.
>
> Olaf