net.inet.ip.random_id possible ASA problems?

[Steve Bertrand]

B. Cook wrote:

[ big snip ]

> So after 6 hours of cisco techs.. all they could come up with is a "...
> possible duplex mis-match.. "
> 
> *sigh*
> 
> So dropping my pf rules (which contain scrub settings) made no
> difference, I found the above URL which seeme to point to
> net.inet.ip.random_id.
> 
> I can not find any 'freebsd.org' documentation pertaining to it
> regarding what it actually does.  I do however find it scattered amongst
> tons of 'FreeBSD hardening' docs..
> 
> Can anyone shed some light on what this does?

IIRC, random_id allows initial TCP sequence numbers to be randomized.

Some OS sequence TCP packets in an incremental fashion, thereby making
it quite easy for an attacker using a TCP Idle Scan to hijack a session,
and extremely easy while the box is under very light network load.

https://www.kb.cert.org/vuls/id/498440

I've never seen this setting cause any detriment, but we only use Cisco
routers, not ASA's. AFAIK, random_id is off by default.

It would be rather handy if they would provide you with some of the
ASA's config snips, and perhaps interface counts and logs.

You may also want to capture a pcap on the 'problematic' box to see if
you can find anything interesting:

# tcpdump -n -i em0 -s 0 -w /home/steve/packet-cap.pcap

Steve
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3233 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20090924/87187504/smime.bin