Subject: Re: How does Linux do RTTM?

From: John Richard Moser <[email-masked]>
Date: Sat, 12 Aug 2006 09:31:42 -0400

David Miller wrote:
> Please use [email-masked] for discussions about the linux
> networking implementation, not [email-masked]
> 

Kay.

I'm told now that it uses Jiffies for TCP timestamps.  I've had thoughts
on this:

 - I figured a random timestamp with random microsecond skew would be
nice but this might expose internals of the RNG; amusingly I'm trying
not to expose internals of the RNG by exposing system time.

 - Someone recommended starting at zero.  This would work, really,
there's no attacks based on guessing the TCP timestamp value.  This is
nice since if I want to hax0rz then I might make a connection and see
how many jiffies there are to get a feel for the system's uptime; this
tells me how long since you upgraded your kernel, so I have an arsenal
of vulns I KNOW you haven't fixed ready ;)  Starting at 0 doesn't give
that information.

Comments?

> Thanks a lot.

- --
All content of all messages exchanged herein are left in the
Public Domain, unless otherwise explicitly stated.

    Creative brains are a valuable, limited resource. They shouldn't be
    wasted on re-inventing the wheel when there are so many fascinating
    new problems waiting out there.
                                                 -- Eric Steven Raymond

    We will enslave their women, eat their children and rape their
    cattle!
                  -- Bosc, Evil alien overlord from the fifth dimension