non-random IP IDs

Hi all.

I was playing a bit on some of my machines with Nessus (www.nessus.org), and it told me the following text:

"The remote host uses non-random IP IDs, that is, it is
possible to predict the next value of the ip_id field of the ip packets sent by this host.

An attacker may use this feature to determine if the remote host sent a packet in reply to another request. This may be used for portscanning and other things.

Solution : Contact your vendor for a patch
Risk factor : Low"

Is there some option to dinamically enable this random IP ID's, or I need to change something and recompile, or just "No way!"?

Please cc me as i'm not subscribed to the list.

Thanks in advance.

--
Alexandre Hautequest
hquest at fesppr.br

"Globalização: Um paraguaio dirigindo pelas estradas brasileiras um carro francês fabricado na Argentina ouvindo música americana num som japonês."

-------------------------------------------------
Esta mensagem foi enviada pelo WebMail da FESP.
Conheça a FESP: http://www.fesppr.br/
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

Nessus is saying something bogus to you.

Ip IDs only matter when packets can be fragmented. If the packet cannot be fragmented, the Ip ID field serves no purpose. Whatever the nessus thing did to test this, it used a IP packet to/from the linux box which had the "Don't Fragment" bit set in the IP header, which as a consequence means the ID field is meaningless.

If the "don't fragment" bit were not set, and fragmentation was possible, Linux will use a randomized ID field. The nessus folks need to fix their test.

Later,
David S. Miller
[email protected]

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/