IP-ID field of ICMP echo request

IP-ID field of ICMP echo request

[Kohei OHTA]

Hi folks,

I found a strange packet, which is generated by ping of Linux.
It is observed ID field of IP header in ping packet (Echo request) is always 0.

I confirmed this on kernel 2.4.18 and 2.4.21.
My colleague also confirmed this is fixed in kernel 2.5.74.

I hope this is fixed in next next 2.4.x release.

I am sorry if this had been fixed already.

#I am not member of this ML.
#If you need any further information, please CC me.

Regards,

Kohei.

Re: IP-ID field of ICMP echo request

[Maciej Soltysiak]

> I found a strange packet, which is generated by ping of Linux.
> It is observed ID field of IP header in ping packet (Echo request) is always 0.
>
> I confirmed this on kernel 2.4.18 and 2.4.21.
> My colleague also confirmed this is fixed in kernel 2.5.74.
>
> I hope this is fixed in next next 2.4.x release.
RFC 792 says:
...
Identifier

   If code = 0, an identifier to aid in matching echos and replies,
   may be zero.
...

I guess it is okay to have 0 as IPID.

Regards,
Maciej

Re: IP-ID field of ICMP echo request

[YOSHIFUJI Hideaki / 吉藤英明]

In article <Pine.LNX.4.51.0307071420020.2129@dns.toxicfilms.tv> (at Mon, 7 Jul 2003 14:29:28 +0200 (CEST)), Maciej Soltysiak <solt@dns.toxicfilms.tv> says:

> > I found a strange packet, which is generated by ping of Linux.
> > It is observed ID field of IP header in ping packet (Echo request) is always 0.
> >
> > I confirmed this on kernel 2.4.18 and 2.4.21.
> > My colleague also confirmed this is fixed in kernel 2.5.74.
> >
> > I hope this is fixed in next next 2.4.x release.
> RFC 792 says:
> ...
> Identifier
> 
>    If code = 0, an identifier to aid in matching echos and replies,
>    may be zero.
> ...
> 
> I guess it is okay to have 0 as IPID.

No, he is not talking about ICMP Identifier (RFC792 Page 14),
but IP Identification (RFC791 Page 29).

--yoshfuji

Re: IP-ID field of ICMP echo request

[Maciej Soltysiak]

> No, he is not talking about ICMP Identifier (RFC792 Page 14),
> but IP Identification (RFC791 Page 29).
Aah, yes, I misread. Sorry.

Anyway I tested it on 2.4.2 and 2.4.18, 2.5.74 and 2.4.21, they set IP ID
to 0. At first I thought it was that issue with early 2.4, but it seems it
has been there for a while.

> --yoshfuji
Maciej

Re: IP-ID field of ICMP echo request

[YOSHIFUJI Hideaki / 吉藤英明]

In article <Pine.LNX.4.51.0307071443080.3379@dns.toxicfilms.tv> (at Mon, 7 Jul 2003 14:48:41 +0200 (CEST)), Maciej Soltysiak <solt@dns.toxicfilms.tv> says:

> > No, he is not talking about ICMP Identifier (RFC792 Page 14),
> > but IP Identification (RFC791 Page 29).
> Aah, yes, I misread. Sorry.
> 
> Anyway I tested it on 2.4.2 and 2.4.18, 2.5.74 and 2.4.21, they set IP ID
> to 0. At first I thought it was that issue with early 2.4, but it seems it
> has been there for a while.

It seems linux-2.2.22 behaves similarly.

Well..., I remember the DF bit.
Kohei, add "-M dont" option (do not set DF flag) and 
we can see non-zero IPID, can't we?

-- 
Hideaki YOSHIFUJI @ USAGI Project <yoshfuji@linux-ipv6.org>
GPG FP: 9022 65EB 1ECF 3AD1 0BDF  80D8 4807 F894 E062 0EEA

Re: IP-ID field of ICMP echo request

[Ulisses]

On Mon, 2003-07-07 at 08:37, Kohei OHTA wrote:

> I found a strange packet, which is generated by ping of Linux.
> It is observed ID field of IP header in ping packet (Echo request) is always 0.
> 
> I confirmed this on kernel 2.4.18 and 2.4.21.
> My colleague also confirmed this is fixed in kernel 2.5.74.
> 
> I hope this is fixed in next next 2.4.x release.

Hi, Kohei,

	I guess this behaviour is to prevent Idle scanning, that is based on
predictable IPID numbers [1]. Therefore, the Linux TCP/IP stack uses 0
as IPID when the DF (Don't Fragment) bit is set. I'm not sure, but I
think that Linux also uses peer-specific IPID numbers to make the
prediction harder.

-- Ulisses

[1] http://www.insecure.org/nmap/idlescan.html

Re: IP-ID field of ICMP echo request

[Kohei OHTA]

Ulisses,

Thanks for your helpful information. I understood the reason.

The article pointed by you says
"Linux 2.4 also uses peer-specific IPID values (see net/ipv4/inetpeer.c)."

That is great.

Kohei.

>>I found a strange packet, which is generated by ping of Linux.
>>It is observed ID field of IP header in ping packet (Echo request) is always 0.
>>
>>I confirmed this on kernel 2.4.18 and 2.4.21.
>>My colleague also confirmed this is fixed in kernel 2.5.74.
>>
>>I hope this is fixed in next next 2.4.x release.
> 
> Hi, Kohei,
> 
> 	I guess this behaviour is to prevent Idle scanning, that is based on
> predictable IPID numbers [1]. Therefore, the Linux TCP/IP stack uses 0
> as IPID when the DF (Don't Fragment) bit is set. I'm not sure, but I
> think that Linux also uses peer-specific IPID numbers to make the
> prediction harder.
> 
> -- Ulisses
> 
> [1] http://www.insecure.org/nmap/idlescan.html
> 
> 
>