Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've seen plenty about Idle Scans and incremental IP IDs on the net, but I have trouble finding a "solution" to the problem. Is there a way to "set" IP IDs for example to all zeros or is it coded into the kernel?

Concrete example: Host has random ip ids, but with a quite low entropy (<5 bit).

In case that you can change it - how does it work under Linux and how does it work under windows?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I just finished reading a section on idle scanning in a textbook less than an hour ago. Here's what it says:

Newer operating systems, such as the recent Linux kernel, OpenBSD, and Windows Vista, randomize the IP ID, but older operating systems and hardware (such as printers) typically do not.

So I think if your machine is running under Vista or 7 (or even 8?), you don't need to worry much about being used as the idle host.

share|improve this answer

The IP ID field is only needed to recognize packets belonging to fragments, so you could set it to 0 for any other packets (apart maybe from DNS, where the IP ID is used as a hack to mitigate cache poisoning). If nothing else works, you can write a small C application based on libnetfilter-queue.

I think Linux actually randomizes the IP ID per connection or so. See what is actually going on before manipulating the configuration. Also, its not usually that critical if someone can portscan your system. If you're concerned about running services, try making them secure instead of hiding them.

share|improve this answer
    
"you could set it to 0" - that's what I'd like to do, but I don't know how. –  user857990 Sep 28 '12 at 14:55
1  
This is tricky stuff. I do not recommend you hack on the IP ID like this. For example, setting IP ID to 0 on all non-fragmented packets is not safe. If you set the IP ID to 0 on packets that do not have the DF flag set, stuff may occasionally break in mysterious ways if any intermediate system fragments your packets along the way. –  D.W. Sep 28 '12 at 18:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.