How often does it happen that we benignly see a TCP packet that is retransmitted but has a different payload the second time?

In other words, how often is it that we see a TCP packet with sequence number S, then later see a second TCP packet with sequence number S but with different (inconsistent) payload data? How often does this happen benignly, not due to an attack?

Motivation: This kind of scenario occurs in some IDS evasion attacks. Some IDS's can be fooled if an attacker sends a TCP packet with harmless payload, then immediately sends a second TCP packet with the same sequence number but now containing a malicious payload. One plausible, naive defense is for the IDS to alert whenever it sees a retransmission that carries a different payload than the original. That raises the question of how many false alerts this will trigger. I have read some older research papers which claim that this happens in the field for benign reasons fairly regularly and thus the false alert rate of the naive defense would be too high. I am wondering if this is accurate, and if it is, just how frequently this happens (excluding attacks).

  • I'm guessing this depends on the TCP implementation. If you send another packet with the same sequence number after an ACK I believe the specification says to drop/discard that packet. Interesting question though. – RoraΖ Apr 6 '16 at 16:37
  • 1
    I doubt that any bug-free stacks do this kind of retransmits so I think you could consider it an attack in most cases. But there is some fresh and interesting research about such kind of malicious injections seen in the wild: arxiv.org/abs/1602.07128, netresec.com/… – Steffen Ullrich Apr 6 '16 at 16:50
  • 1
    @SteffenUllrich, yeah, that was my intuition too... but I see all of these older research papers that claim the opposite -- they go out of their way to say that considering it an attack will cause too many false positives. That makes me doubt whether going on intuition is enough. RoraZ, you might be misunderstanding my question; my question is an empirical question about the prevalence of a certain pattern of packets. I'm not asking what TCP implementations do when they receive such a pattern of packets; I'm asking how often this pattern happens. – D.W. Apr 6 '16 at 17:13
  • An example where this happened due to buggy code: stackoverflow.com/questions/29658336/…. And in the paper The Cyclone Server Architecture: Streamlining Delivery of Popular Content (2000) they explicitly allow this case for their server architecture which I find questionable. – Steffen Ullrich Apr 6 '16 at 17:36
  • 1
    But what is probably legal and used in practice is if the retransmit contains more data than the first packet, because in the mean time more data were send on the socket. E.g. first packet seq 10, len 20 and retransmit seq 10, len 40. So the evasion detection would have to deal with this case. – Steffen Ullrich Apr 6 '16 at 17:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.