lkml.org 
[lkml]   [2001]   [Jan]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: ECN: Clearing the air


On Sun, 28 Jan 2001, Chris Wedgwood wrote:

> On Sat, Jan 27, 2001 at 07:23:51PM -0500, jamal wrote:
>
> suggested blocking ECN. Article at:
>
> http://www.securityfocus.com/frames/?focus=ids&content=/focus/ids/articles/portscan.html
>
> the site is now ATM -- can someone briefly explain the logic in
> blocking it?
>

It is Queso they quoted not nmap, sorry -- same thing.
The idea is to "detect" port scanners.
Queso sets the two TCP reserved bits in the SYN (now allocated for ECN).
Some OSes reflect that back in the SYN-ACK (Linux < 2.0.2? for example
was such a culprit).
Queso could then use that information to narow down the OS detection.
I suppose the idea is to detect Queso and react to it ;->

cheers,
jamal



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:24    [W:0.056 / U:0.084 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site