Re: IP-ID field of ICMP echo request

[Kohei OHTA <kohei@cysols.com>]

Ulisses,

Thanks for your helpful information. I understood the reason.

The article pointed by you says
"Linux 2.4 also uses peer-specific IPID values (see net/ipv4/inetpeer.c)."

That is great.

Kohei.

>>I found a strange packet, which is generated by ping of Linux.
>>It is observed ID field of IP header in ping packet (Echo request) is always 0.
>>
>>I confirmed this on kernel 2.4.18 and 2.4.21.
>>My colleague also confirmed this is fixed in kernel 2.5.74.
>>
>>I hope this is fixed in next next 2.4.x release.
> 
> Hi, Kohei,
> 
> 	I guess this behaviour is to prevent Idle scanning, that is based on
> predictable IPID numbers [1]. Therefore, the Linux TCP/IP stack uses 0
> as IPID when the DF (Don't Fragment) bit is set. I'm not sure, but I
> think that Linux also uses peer-specific IPID numbers to make the
> prediction harder.
> 
> -- Ulisses
> 
> [1] http://www.insecure.org/nmap/idlescan.html
> 
> 
>