tcp seq number prediction

Question

While testing a system, nmap told me that the tcp seq number prediction is really low, (trivial joke). There is only one system in the whole range that gives me that answer. Some papers, e.g. a weakness in the 4.2 bsd unix tcp/ip software, that even though it's old, describes the problem, seem to point that today seq numbers are generated more securely.

I wondered, is there any other tool then nmap with which I could verify the tcp seq number prediction? It'd give me more confidence in the result.

Answer 1

You can use hping --seqnum to get a dump of sequence numbers, with differences shown. For extremely trivial sequences, this might give you a result.

#hping2 win98 --seqnum -p 139 -S -i u1 -I eth0
HPING uaz (eth0 192.168.4.41): S set, 40 headers + 0 data bytes
2361294848 +2361294848
2411626496 +50331648
2545844224 +134217728
2713616384 +167772160
2881388544 +167772160
3049160704 +167772160
3216932864 +167772160
3384705024 +167772160
3552477184 +167772160
3720249344 +167772160
3888021504 +167772160
4055793664 +167772160
4223565824 +167772160

I don't know of any tool (other than nmap) that'll directly analyse the predictability. You could always collect a few hundred thousand and send the number through Diehard to see how well they perform, but I don't know how meaningful that'll be.

As an aside, this article on attractors in TCP sequences is a very cool visualisation of the poor RNG techniques used in some systems.