nddconf More random tcp sequence tcp_isn_passphrase

[Gunwant]

Hi all,

I want to set tcp_isn_passphrase parameter value to 0 for tcp.

I am using ndd -set /dev/tcp tcp_isn_passphrase 0
command to set it to 0.

But this value is not reflected in nddconf file.

When I manually chenged NDD_VALUE[5]=0,
and run following command

ndd -get /dev/tcp tcp_isn_passphrase

it give result 1.

i want to know , do i need to reboot the machine to get values reflected in nddconf file ,

or there is any other to achieve the same .

Thanks in advance .

[Laurent Menase · Accepted solution]

when you do ndd -set /dev/tcp tcp_isn_passphrase 0
it set a isn passphrase to the string "0".
Once enabled there is no way to disable tcp_isn_passphrase,

so when you do ndd -get /dev/tcp tcp_isn_passphrase
it answeres 1 which means that tcp_isn_passphrase had been set.
- it never shows the value for security considerations-
So even if you reboot , and with tcp_isn_passphrase set to 0 in nddconf,
ndd -get /dev/tcp tcp_isn_passphrase will always return 1

To disable tcp_isn_passphrase, you need to remove it from nddconf and reboot.

[Steven E. Protter]

Shalom,

change the value manually in the nddconf file. Doing it on the fly as you did, does not change nddconf

Use the same format as other parameters.

Reboot is not required.

SEP

[Gunwant]

Thanks both of you

[rick jones]

Is there a particular reason you want more predictable initial sequence numbers??

[Gunwant]

According to standards it's a security measure to make sure of usinf more random tcp numbers

[Laurent Menase]

And setting tcp_isn_passphrase to 0 will make them to be random. Because the passphrase will be "0"

[Gunwant]

No no, I want to check if tcp_isn_passphrase is set or not.

I didn't know how to set and unset the value
tcp_isn_passphrase.

Actually , the result of
ndd -get /dev/tcp tcp_isn_passphrase is 1 thet means it is set to some value. Not necessary to ZERO 0.

[Laurent Menase]

Yes
ndd -get /dev/tcp tcp_isn_passphrase
1 -> means is set whatever value it is and
can't be reset
ndd -get /dev/tcp tcp_isn_passphrase
0 -> means is not set


as soon as a ndd -set /dev/tcp tcp_isn_passphrase anything
is made, it sets the passphrase to "anything"
and there is not way to reset it
so ndd -get /dev/tcp tcp_isn_passphrase will answer 1

[Gunwant]

thanks

[Gunwant]

I have a question , is this the default configuration (tcp_isn_passphrase with some value) or we have to do it manually after installation.

How the value is used to generate random nombers.

[Laurent Menase]

> I have a question , is this the default
> configuration (tcp_isn_passphrase with some
> value) or we have to do it manually after
> installation.

by default tcp_isn_passphrase is not enabled.

As soon as you enter a line with tcp_isn_passphrase param in nddconf, then it is enabled.

> How the value is used to generate random
> nombers.

For security reason this can't be explained.
It hashes it with some other none deterministic values of the kernel to obtain a random seed