Re: "LAND" Attack Update

From: Charles M. Hannum (mycroftat_private)
Date: Sat Nov 22 1997 - 18:35:55 PST

  • Next message: Aleph One: "Re: XFree86 insecurity"

    Casper Dik <casperat_private> writes:
    
    >
    > >2) A socket in LISTEN state is not initiating a connection attempt, so
    > >   if it receives a SYN-only packet from itself, it *must* be a
    > >   forgery.  A self-connect would cause the socket to no longer be in
    > >   LISTEN state before the SYN-only packet arrives.  There's no point
    > >   in sending a RST in this case, since we'd just be sending it to
    > >   ourselves.
    >
    > I'm not sure that that is the case.  Multiple sockets may be bound to
    > the same port number.  One of the others bound to the port may
    > initiate a connection from the same port number.
    
    If the source and destination addresses are the same, then it *can't*
    be another socket on the same port connecting.  It's just not
    possible.
    
    > You need to reply with a SYN_ACK packet and then you'll RST in reply to
    > that.
    
    The second part is merely an optimization, but it is correct.
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:33:06 PDT