Hi,
> I beg your pardon, but although the *possibilities* are in a range of
> 2^32,
> by measuring the roundtriptime and sniffing the packets coming from your
> "victim" you should be able to guess the sequence number in a
> *reasonable*
> amount of time.
Umm... how can you guess the ISN by measuring the RTT? And of course you
can't sniff the Packet from your victim (you dont need to measure anything if
you can sniff the packet, since the ISN is written clear in it).
If you can sniff the packet it was directed to you anyway. It is possible to
sniff the Packet if you are on the same Lan or on the Upstream Link, but
this is usually not the case for attackers. (The local LAN should be secured
and the Upstream Links trusted, at least as long as you use insecure
authentication which relies on the Source-IP).
Greetings
Bernd
Follow-Ups:
References:
|
|
