On Wed, 17 Oct 2007, Stephen Hemminger wrote:
On Wed, 17 Oct 2007 23:15:48 +0200 (CEST)
Krzysztof Oledzki <[EMAIL PROTECTED]> wrote:
Hello,
Is it normal that TCP port randomization (tested with 2.6.22) works only
when explicitly binding to a IP address:
--- cut here ---
[EMAIL PROTECTED]:~# nc 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
[EMAIL PROTECTED]:~# nc 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
[EMAIL PROTECTED]:~# nc 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
23:11:11.896126 IP 192.168.129.2.37839 > 192.168.129.28.11: S
23:11:12.146573 IP 192.168.129.2.37840 > 192.168.129.28.11: S
23:11:12.396488 IP 192.168.129.2.37841 > 192.168.129.28.11: S
--- cut here ---
--- cut here ---
[EMAIL PROTECTED]:~# nc -s 192.168.129.2 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
[EMAIL PROTECTED]:~# nc -s 192.168.129.2 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
[EMAIL PROTECTED]:~# nc -s 192.168.129.2 192.168.129.28 11
(UNKNOWN) [192.168.129.28] 11 (systat) : Connection refused
23:11:31.704391 IP 192.168.129.2.57204 > 192.168.129.28.11: S
23:11:34.400048 IP 192.168.129.2.14512 > 192.168.129.28.11: S
23:11:34.606707 IP 192.168.129.2.20117 > 192.168.129.28.11: S
--- cut here ---
Best regards,
Krzysztof Olędzki
It is a expected side effect.
So it is not possible to use randomization without binding to a specific
srcip?
The starting point for the search
is based on hash(srcaddr, dstaddr, dstport, secret).
You are using same source, dest and port so yes it will stay
the same until rekeying occurs.
The secret only changes every 5min same as TCP initial sequence number.
If I get it right, even with explicitly selected constant srcaddr port
numbers should simply increase? This is not what I observed.
Thanks.
Best regards,
Krzysztof Olędzki
