Back to files

attacks against snort-1.8.3, reported Jan 28, 2002:

1. older TCP retransmission chaff (snort's TCP segment reassembly seems to always favor newer data, even for properly sequenced received data):

        tcp_seg 1
        tcp_chaff rexmit
        order random

2. forward TCP segmentation overlap, favoring newer data (both Windows

and Unix operate this way, in contrast to Ptacek and Newsham's results):

tcp_seg 1 new

3. chaff TCP segments with older TCP timestamp options forcing PAWS

elimination

        tcp_seg 1
        tcp_chaff paws
        order random

4. older IP fragment duplicates (snort's IP fragment reassembly seems

to always favor newer data, even for properly sequenced received data):

        ip_frag 8
        ip_chaff dup
        order random

5. IP duplicate fragment chaff with bad options:

        ip_frag 8
        ip_chaff opt
        order random

6. either TCP or IP chaffing with short TTLs (that expire before

reaching the end host, but pass by the monitor):

        ip_frag 8
        ip_ttl 11
        ip_chaff 10
        order random

        tcp_seg 1
        ip_ttl 11
        tcp_chaff 10
        order random

there are probably timing attacks against snort's reassembly possible as well, but i haven't played with it enough to see.