full-disclosure - Re: (ICMP attacks against TCP) (was Re: HPSBUX01137 SSRT5954

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6.2.0.14.0.20050722000220.02030020@pop.frh.utn.edu.ar>
Date: Fri Jul 22 04:51:44 2005
From: fernando at frh.utn.edu.ar (Fernando Gont)
Subject: Re: (ICMP attacks against TCP) (was Re:
	HPSBUX01137 SSRT5954 

At 02:17 p.m. 21/07/2005, Casper.Dik@....COM wrote:

> >> There are still some radio links with MTUs of 296 bytes.
> >
> >Go search with google....people still actively use smaller MTUs.
> >
> >What do you do?  Where do you draw the line in the sand?
>
>Well, the minimum requirement for "you must be able to reassemble this"
>is 576; so you use PMTU until you go as low as 576 at which point you
>stop using the DF bit

I assume you are not proposing this as the solution to the problem.

If you do, I'd just spoof an ICMP "fragmentation needed and DF bit set" 
that advertises an MTU lower than 576.
And then would attack you with IP fragments.

Kindest regards,

--
Fernando Gont
e-mail: fernando@...t.com.ar || fgont@....org