Changing IP ID generation of a server

Question

I've seen plenty about Idle Scans and incremental IP IDs on the net, but I have trouble finding a "solution" to the problem. Is there a way to "set" IP IDs for example to all zeros or is it coded into the kernel?

Concrete example: Host has random ip ids, but with a quite low entropy (<5 bit).

In case that you can change it - how does it work under Linux and how does it work under windows?

Answer 1

I just finished reading a section on idle scanning in a textbook less than an hour ago. Here's what it says:

Newer operating systems, such as the recent Linux kernel, OpenBSD, and Windows Vista, randomize the IP ID, but older operating systems and hardware (such as printers) typically do not.

So I think if your machine is running under Vista or 7 (or even 8?), you don't need to worry much about being used as the idle host.

Answer 2

The IP ID field is only needed to recognize packets belonging to fragments, so you could set it to 0 for any other packets (apart maybe from DNS, where the IP ID is used as a hack to mitigate cache poisoning). If nothing else works, you can write a small C application based on libnetfilter-queue.

I think Linux actually randomizes the IP ID per connection or so. See what is actually going on before manipulating the configuration. Also, its not usually that critical if someone can portscan your system. If you're concerned about running services, try making them secure instead of hiding them.