Contributed by jose on from the fix-up-TCP dept.
reassemble tcp Statefully normalizes TCP connections. scrub reassemble tcp rules may not have the direction (in/out) specified. reassemble tcp per- forms the following normalizations: ttl Neither side of the connection is allowed to reduce their IP TTL. An attacker may send a packet such that it reach- es the firewall, affects the firewall state, and expires before reaching the destination host. reassemble tcp will raise the TTL of all packets back up to the highest value seen on the connection. timeout modulation Modern TCP stacks will send a timestamp on every TCP pack- et and echo the other endpoint's timestamp back to them. Many operating systems will merely start the timestamp at zero when first booted, and increment it several times a second. The uptime of the host can be deduced by reading the timestamp and multiplying by a constant. Also observ- ing several different timestamps can be used to count hosts behind a NAT device. And spoofing TCP packets into a connection requires knowing or guessing valid times- tamps. Timestamps merely need to be monotonically in- creasing and not derived off a guessable base time. reassemble tcp will cause scrub to modulate the TCP times- tamps with a random number.this was added to 3.4, http://www.openbsd.org/plus34.html reads:
More TCP scrubbing: Modulate TCP timestamps to frustrate NAT detection and prevent remote uptime guesses. New scrub option 'reassemble tcp'.on my home gateway this rule does the job:
scrub on $tun_if random-id reassemble tcpall about scrub rules can be read in the manpage: pf.conf(5) "
(Comments are closed)
By Foxy () foxy@free.fr on http://foxy.free.fr
2 others papers on NAT detection (based on IP ID) :
- http://www.sflow.org/detectNAT/
- http://www.research.att.com/~smb/papers/fnat.pdf