Security issue with TCP SYN packets on Linux Post: 66158

9 More Discussions You Might Find Interesting

1. Red Hat

How to check the outbound packets in Linux

I have a linux redhat box , our security department in my company informed me that my server's IP sends So many traffic in my network , This box I am using it as FTP server to store the other servers logs . My question briefly is how to check my outbound packets which are going from my PC to the...

2. IP Networking

Could a tcp issue be causing a null pointer exception?

The client's app gets a 'suspend error' which they say is due to a null pointer exception. Application people say nothing's wrong with the app. Network people say the network's fine. I'm supposed to see what's wrong with the system to be causing this error. I checked the NIC card settings, which...

3. UNIX for Dummies Questions & Answers

Linux box drops the incoming packets

Hi all, I am new to Linux kernel. we have a c file that counts the no. of sends and received packets in each interface, and indicate the user about the error/drop ration of incoming and outgoing packets. in our Linux box , the incoming packets are dropped at random interval. we have our...

4. Linux

Linux dhcp client boot process with packets traffic

Hi Everybody, I would like to know the entire network packets exchange, sequence between a linux dhcp client workstation & dhcp server as client comes up starting from OS booting stage as network service starts to the time client gets dhcp IP address. This would be in a typical LAN ...

5. Solaris

TCP SYN timer

Can anybody please tell me how I can figure out on a solaris server how long it would take a TCP SYN request to timeout before it gets a SYN_ACK back? Thanks,

6. IP Networking

how to hack linux driver to delay incoming packets

hello, can anyone suggest how to delay the incoming packets ?? or how the packets are prossed inside the kernal and a way to make the packets wait a while?? it wud be vry helpful regards sameer

7. IP Networking

Packets sent from Linux TCP socket

Hello, Our software is using a TCP socket (AF_INET, SOCK_STREAM) to communicate with an Ethernet device. When we send a message, the message object writes itself in full onto the socket's stream buffer before the software invokes send() from socket.h. I'm still researching, but have 2...

8. IP Networking

TCP Same Ack Sequencing for Two Packets

I was analyzing a TCP snoop. And found following scenario From Server to Client ---> SEQ 2993 ACK 1744 WIN 8192 LEN 13 From Server to Client ---> SEQ 3006 ACK 1744 WIN 8192 LEN 13 From Client to server --> SEQ 1744 ACK 3019 WIN 3304 I just want to know Why Packet 1 and 2...

9. IP Networking

TCP MSS Issue

Gretings! I have developed simple utility using Berkly sockets interface: So, what do I? $ ifconfig lo mtu 1500 $ make //run netcat $ ./target 127.0.0.1 5555 1460 1000000 #mss: 1460, loop sleep: 1s On other virtual terminal: $ netcat -l 127.0.0.1 -p 5555 On third virtual terminal: #...

LEARN ABOUT OSF1

synos

synos(1)							Mail Avenger 0.8.3							  synos(1)

NAME

       synos - guess operating system from TCP SYN fingerprint

SYNOPSIS

       synos [--mtu mtu] [--db path] syn-fingerprint

DESCRIPTION

       synos takes a SYN fingerprint, in the format described for the CLIENT_SYNFP environment variable in the avenger(1) man page, and outputs a
       guess as to the type of the client operating system.  synos makes use of the OpenBSD SYN fingerprint database (which is also repackaged
       with Mail Avenger).

   OPTIONS
       --mtu val
	   Certain operating systems set the initial TCP window size based on the maximum transmission unit, or MTU, of the network.  For such
	   operating systems, synos usually checks the window size using both the client's MSS option plus 40 bytes (for TCP and IP headers), or a
	   hard-coded MTU, which defaults to 1,500 bytes.  If either value works, the fingerprint is considered to match the operating system.
	   You can change the value 1,500 by specifying this option.  A value of 0 tells synos to use only the value derived from the MSS option.

       --db file
	   Specifies an alternate location for the SYN fingerprint database.

FILES

       /usr/local/share/pf.os
	   Default location of SYN fingerprint database.

SEE ALSO

       avenger(1), asmtpd(8)

       The Mail Avenger home page: <http://www.mailavenger.org/>.

       The OpenBSD home page: <http://www.openbsd.org/>.

BUGS

       The operating system type is determined by heuristics that are not always reliable.  Moreover, not all operating systems can be
       distinguished.  The database may not even contain a client's particular operating system and version.

       It is not hard to fool synos deliberately by changing TCP socket options or injecting raw packets onto the network.

AUTHOR

       David Mazieres

Mail Avenger 0.8.3						    2012-04-05								  synos(1)