TCP RST attack

[Dag-Erling Smørgrav]

Dragos Ruiu <dr at kyx.net> writes:
> On April 20, 2004 10:44 am, Dag-Erling Smørgrav wrote:
> > The advisory grossly exaggerates the impact and severity of this
> > fea^H^H^Hbug.  The attack is only practical if you already know the
> > details of the TCP connection you are trying to attack, or are in a
> > position to sniff it.
> This is not true. The attack does not require sniffing.

You need to know the source and destination IP and port.  In most
cases, this means sniffing.  BGP is easier because the destination
port is always 179 and the source and destination IPs are recorded in
the whois database, but you still need to know the source port.

DES
-- 
Dag-Erling Smørgrav - des at des.no