From: Daniel Lucq (daniel@lucq.org)
Date: Thu Jan 15 2004 - 10:59:52 EST
On Wed, 14 Jan 2004, Alla Bezroutchko wrote:
> Paul Johnston wrote:
> > 3) Ports where the TTL is different on the SYN reply to the rest of the
> > connection. ipid's also imply that different hosts are handling the SYN
> > and the rest of the connection.
>
> I've seen that on a server behind a Cisco PIX firewall with SYN flood
> protection enabled. The firewall handles connection setup itself and
> once the handhsake is complete, establishes the connection with the
> server behind it. If the handshake is not complete the server never sees
> any of it.
OpenBSD 3.4 PF also exhibits this behavior when using the SYN proxy
feature, for instance with an OpenBSD firewall and a Windows web server
behind it (TCP handshake would use TTL somewhat less than 64, whereas data
packets would use TTL somewhat less than 128).
However, you can mask this by fiddling with the PF traffic normalization
options on the firewall (specifically, the min-ttl option, and the
random-id option; see your nearest pf.conf(5) manpage, or the manpages on
the OpenBSD website for more information).
Regards,
Daniel
---------------------------------------------------------------------------
----------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:45 EDT