Download Dealing with sequence-number randomizing firewalls

Survey
yes no Was this document useful for you?
   Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

page
1
page
2
page
3
page
4
page
5
page
6
page
7
page
8
page
9
page
10
page
11
Document related concepts
no text concepts found
Transcript 
Dealing with sequence-number
randomizing firewalls
Benjamin Hesmans, Christoph Paasch,
Olivier Bonaventure
UCLouvain, IP Networking Lab
Sequence number randomization
● Some (old) TCP-stacks did not sufficiently
randomize their initial TCP sequence
number
● Firewalls "fixed" it by randomizing TCP
sequence numbers
But some of them forgot SACK
1
Sequence number randomization
TCP-seq: 1
Data
TCP-seq: 1001
Data
TCP-seq: 2
Data
TCP-seq: 3
Data
TCP-seq: 1003
Data
2
Sequence number randomization
TCP-ack: 1002
TCP-ack: 2
TCP-ack: 1002
SACK: 1003 - 1010
TCP-ack: 2
SACK: 1003 - 1010
Discard SACK-info
Disregard duplicate ACK
3
Sequence number randomization
TCP-seq: 2
Data
TCP-seq: 3
Data
TCP-seq: 1003
Data
RTO
TCP-seq: 2
Data
TCP-seq: 1002
Data
4
Performance Impact
Linux or
Mac OS/X
Loss-rate 0% to 2.5%
BW-shaping 10Mbps
TCP-seq: 3
Data
TCP-seq: 1003
Data
5
Performance Impact
6
Accounting duplicate ACKs
Duplicate ACKs with invalid SACK-blocks
should not be discarded.
7
Accounting duplicate ACKs
8
Conclusion
● Middleboxes mess up with our connections
● And they probably won't go away
● We have to consider the middleboxes in our
protocols
9
Fast-Retransmission counters
9
Related documents