Re: TCP RST attack (the cause of all that MD5-o-rama)

E.B. Dreger wrote:

I don't think we're even that far along. If I'm reading FreeBSD 4.9 and NetBSD 1.6.2 source correctly,

/usr/src/sys/netinet/in_pcb.c

Should have stretched as far as OpenBSD then. Same file.

tells all.

AFAIK, sequential search is about it. Try a port number, verify that the src/dist ip+port combination is available, then go on to the next lport if the guessed one is in use.

As far as I can see - I have never read the code before, just the commit messages - the OpenBSD version does a circular, random search between high and low targets. Peter