Subject: Re: random ip_id must be configurable
To: None <email@example.com>
From: Darren Reed <firstname.lastname@example.org>
Date: 10/07/2003 06:48:49
> On Fri, Sep 12, 2003 at 11:04:36PM -0000, Darren Reed wrote:
> > > i got a couple of references on ip_id/DNS id attacks:
> > >
> > > smb's paper on counting hosts behind NAT using ip_id. if you use
> > > non-random ip_id, number of hosts behind NAT will be revealed.
> > Yes. And so what ? This change (generating pseudo-random ones for NetBSD)
> > does nothing to address the problem for NAT unless it is a NetBSD box that
> > is being NAT'd. IPFilter 4.0 provides an adequate knob (unlike pf) that
> > resolves this.
> we have a knob for that in pf since at least 6 months.
> am I missing something or do you?
How would I know what you're missing? I do know I'm not in this instance.