TCP – Behavior of TCP Layer Upon Receiving Wrong Sequence Number

networkingtcp

I have the IP and port details of an already established connection between the TCP server and the client. As I am simulating packet injection attack using the packETH tool, I disguise my self as the client(using client's IP and port, but not same seq and ack numbers) and send FIN segment, then I expect connection close or some abnormal behavior, but it isn't happening.
My question is, what might exactly be happening? and what happens if I send a repeated SYN segment.

Best Answer

I'd try it with the RST bit set. Your SEQ/ACK shouldn't matter in that case. If that doesn't work it is probably because you messed up your checksum and the packet is getting dropped.

Related Solutions

TCP Termination – Understanding Sequence Number of Segments in TCP Termination Process

It is clearly spelled out in RFC 793 Transmission Control Protocol, Section 3.5 Closing a Connection:

      TCP A                                                TCP B

  1.  ESTABLISHED                                          ESTABLISHED

  2.  (Close)
      FIN-WAIT-1  --> <SEQ=100><ACK=300><CTL=FIN,ACK>  --> CLOSE-WAIT

  3.  FIN-WAIT-2  <-- <SEQ=300><ACK=101><CTL=ACK>      <-- CLOSE-WAIT

  4.                                                       (Close)
      TIME-WAIT   <-- <SEQ=300><ACK=101><CTL=FIN,ACK>  <-- LAST-ACK

  5.  TIME-WAIT   --> <SEQ=101><ACK=301><CTL=ACK>      --> CLOSED

  6.  (2 MSL)
      CLOSED

                         Normal Close Sequence

                               Figure 13.

The RFC is the definition of TCP, and textbooks may have errors (it happens all the time). It is a good idea to also study the RFCs of any protocols which you are learning.

TCP Handshake – Understanding Three-Way Handshake and DoS Attacks

why attackers just do the first step of 3-way handshake? why don't they just complete all three steps of 3-way handshake to be fully connected with the server just like normal users so it is going to take up the resource of the server

When just sending a SYN to allocate resources on the server the attacker can spoof the IP address and thus hide its real IP address. To create a full handshake the attacker cannot use IP spoofing because the final ACK must be in response to the servers SYN which the client does not get if the original SYN was IP spoofed.

But if the original SYN has done no harm at the server, why the hash function is needed to create a 'cookie' for the server to identify the user's SYN segment in the first step of 3-way handshake to see whether it is valid?

If only a simple predictable function is used to compute the servers ISN from the clients SYN then the attacker might create the final ACK without seeing the servers actual SYN. In this case the attacker could IP spoof not only the SYN but also the ACK and would thus cause the allocation of even more resources on the server.

Best Answer

Related Solutions

TCP Termination – Understanding Sequence Number of Segments in TCP Termination Process

TCP Handshake – Understanding Three-Way Handshake and DoS Attacks

Related Topic