Re: [fw-wiz] Firewalls that generate new packets..

Darden, Patrick S. wrote:
Marcus J. Ranum
...
The hard thing I had to wrap my brain around was the
observation that between a router+ACLs combined
with the state that is held in the TCP stack of the
target, you've got exactly the same thing (and often
quite a bit better!) than a "stateful" firewall.


I respecfully disagree for all the reasons I have outlined
before.... Sum: tcp sequence #s make a difference.


So long as you mean "tcp sequence#s" to mean modelling the entire
TCP connection state, yes. The implication that you're missing is that
the TCP window also needs to be tracked (including whether or not
window scaling is being used), along with which flags appeared at
which sequence numbers so you know what to expect next. e.g
the SYN and FIN flags impact sequence numbers without there being
an explicit change in the headers.

If you go to the extreme of only allowing in sequence TCP packets
and ensure that retransmitted data is always the same as the original,
you could argue that the "stateful inspection" mode here becomes a
layer 5 firewall rather than layer 3 or 4. And that's without a proxy :)

Darren

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: ISP Redundancy Configuration
    ... What I posted is directly from RFC793 describing how the TCP connection is ... Ack sequence numbers do not and should not increment ...
    (comp.security.firewalls)
  • Re: [fw-wiz] Firewalls that generate new packets..
    ... You're assuming a blind attack, ... are stymied by hard-to-predict sequence numbers and the attacker ... TCP handshake stage. ... "Prearranged formula decided on during the TCP handshake?" ...
    (Firewall-Wizards)
  • Re: ISP Redundancy Configuration
    ... So I can establish the connection and when I try from the ... Ack sequence numbers do not and should not increment ... after that the end points will be send an ack packet with data, ... In line 2 of figure 7, TCP A begins by sending a SYN segment ...
    (comp.security.firewalls)
  • RE: [Full-Disclosure] Core Internet Vulnerable - News at 11:00
    ... > attack on TCP BGP sessions? ... Sequence number prediction isn't really ... PSEPC AV04-019 SPPCC - TCP ... The fact that TCP sessions can be reset by sending suitable RST and SYN ...
    (Full-Disclosure)
  • [EXPL] TCP Reset Spoofing Generic Exploit
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The TCP stack implementation of numerous vendors contains a flaw that may ... RFC-793 utilizes sequence checking to ensure proper ordering of received ...
    (Securiteam)