svn commit: r280971 - in head: contrib/ipfilter/tools share/man/man4 sys/contrib/ipfilter/netinet sys/netinet sys/netipsec sys/netpfil/pf

[Hans Petter Selasky]

On 04/03/15 13:29, Gleb Smirnoff wrote:
> On Fri, Apr 03, 2015 at 12:41:54PM +0200, Hans Petter Selasky wrote:
> H> "ip_do_randomid" is zero by default, and is not documented anywhere:
> H>
> H> grep -r ip_do_randomid share/
>
> It is documented in inet(4).
>
> The actual sysctl knob doesn't match the kernel symbol name, which is
> allowed in sysctl(9).
>

Hi,

Will you mind if I rephrase that paragraph in the "inet.4" manual page from:

"This closes a minor information leak which allows remote observers to
determine the rate of packet generation on the machine by watching the
counter."

Into:

"This prevents high-speed information exchange between internal and 
external observers using packet frequency modulation. An outside 
observer can ping the outside facing port at a fixed rate watching the 
counter. An inside observer can ping the inside facing port watching the 
same counter. Even though packets don't flow between the two ports, data 
can be exchanged by watching changes in the packet rate. It is believed 
that data can be exchanged in Kb/s range this way. Setting this sysctl 
also prevents remote and internal observers to determine the rate of 
packet generation on the machine by watching the counter."

--HPS