General Classes of TCP/IP Problems TCP timers exist as a part of connection-oriented delivery TCP sequence numbers exist as part of reliable delivery The two main groups where TCP/IP security and/or Denial of Service problems occur from IP Spoofing TCP Sequence Prediction

Guarding against TCP/IP Problems Unfortunately, the problems are inherent in the protocol since the designers created it for trust and delivery Cryptography in the form of encryption and authentication would cut down on spoofing problems Software Fixes such as TCP wrappers, disabling BSD-r protocols, .rhosts files Designing networks with good network topologies and no inherent trust relationships

TCP Timers Retransmission Timer Connection Timer 2MSL Persist Timer Used when a host expects and ACK from the other side Connection Timer The initial timer set when a connection is established when a SYN is sent 2MSL The timer used to measure TIME_WAIT state Persist Timer Timer used to keep window size information exchanged Keepalive Timer (Polling) Keeps an idle connection alive

General Class of Routing Problems Primarily dealing with problems at the network level IP Source Routing An attacker can choose a desired IP RIP Bogus routing information can be propagated to networks EGP Core gateways occasionally poll each other and uses sequence numbers that must be echoed by other end ICMP ICMP redirects to advise bogus routes Denial of service attack from Ping floods

General Class of TCP Problems IP Spoofing TCP Sequence Guessing Connection Hi-jacking Simultaneous Open SYN, SYN-FIN, SYN-ACK Timing Problems - Desynchronized States

IP Spoofing A remote host can trivially send spoofed IP addresses to a victim host This attack must be in conjunction with sequence prediction since an incorrect sequence numbers have the target host send RST segments Difficult to defend against

TCP Sequence Prediction Problem The ISN uses a global counter for the initial number The increment is usually 64 SYN = ISN + Increment 4.2 BSD implementations violate RFC protocol by setting ISN = 1