Messages in this thread | | | Subject | Re: [Patch] IPv4 TCP security impovement | Date | Sat, 09 Jan 1999 18:56:32 -0500 | From | "Brandon S. Allbery KF8NH" <> |
| |
In message <19990108200745.B664@rhea>, Joachim Baran writes: +----- | On Fri, Jan 08, 1999 at 06:03:58PM +0100, Andi Kleen wrote: | > that on a dynamic IP dialup machine, someone else uses the same IP first, | > opens a connection to a server, hangs up without closing the connection | > properly, you get the same IP, the server sends TCP packets to the | > local port of the old connection. For that the TCP standard requires to | Hm, my client also gets the same port? I think that's | not very reasonable. +--->8
Perhaps, but not all ISPs have so many available addresses in their dynamic IP pool that they can let an address lie fallow for a few hours. And even then, some programs may continue to send packets for a long time: AFS servers will continue to send callback-break packets to a client for several hours after that client has gone away or shut down AFS.
| > send RSTs, because otherwise the other end will not notice that something | > went wrong and trying again for a long time (using up your bandwidth etc.). | I'm talking about UNCONNECTED ports. Understand the +--->8
He's talking about an interrupted connection that had been established by or to the last holder of your IP address. The remote doesn't know that the peer it was talking to is no longer there, and it won't find out because you aren't RST'ing their packets.
-- brandon s. allbery [os/2][linux][solaris][japh] allbery@kf8nh.apk.net system administrator [WAY too many hats] allbery@ece.cmu.edu carnegie mellon / electrical and computer engineering KF8NH We are Linux. Resistance is an indication that you missed the point.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |