topic Re: non-random ip ids in Operating System - HP-UX

non-random ip ids

Peter Gillis — Wed, 08 Sep 2004 21:53:24 GMT

HI,
ux11i.
After running a network vulnerability scan on our system we have a message returned that indicates it is possible to predict the next
value of the ip_id field of the ip packets sent by this host.
Have found a previous post which has led me to a patch PHNE_29887. cumulative ARPA transport patch. But, I'm sure I have seen somewhere that 11i op system not supposed to need extra patches, it already has the ability to random choose next ip ids. I have installed the HP Stron Random Number Generator too. So, why is the system not saying it can select random numbers?

Bit confused
Maria

Re: non-random ip ids

rick jones — Thu, 09 Sep 2004 20:18:05 GMT

The strong random number generator stuff is only (IIRC) for providing /dev/random and such. It is not related to providing random IP datrgram IDs.

I myself am not all that worried about non-random IP datagram IDs given that TCP traffic is so very rarely fragmented to begin with. I suppose it might be more of a concern with UDP traffic but even then.

Perhaps the randomization of IP datagram IDs is controlled by an ndd setting on 11i? That or perhaps it is part of a subsequent TOUR.

BTW, _which_ 11i are you talking about? There are several.

Re: non-random ip ids

Peter Gillis — Thu, 09 Sep 2004 20:57:16 GMT

Hi Rick, Thanks for response.
11.11 v1.
What is a TOUR?
Regards,Maria

Re: non-random ip ids

Dave Olker — Thu, 09 Sep 2004 22:11:25 GMT

Hi Maria,

TOUR stands for Transport Optional Upgrade Release, and it is an additional, fully supported, web release that delivers new transport functionality and other networking features independent of major HP-UX releases.

You can download the latest version of TOUR, and all of the documentation, from Software Depot at:

http://www.software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=TOUR

The TOUR packages are free.

Regards,

Dave