Subject: FWD:: Re: [e2e] Re: Question on "identification" field of IP header

From: Mark Allman <[email-masked]>
Date: Wed, 18 Dec 2002 10:36:22 -0500

------- Forwarded Message

From: Rick Jones <[email-masked]>
Subject: Re: [e2e] Re: Question on "identification" field of IP header
To: [email-masked]
Date: Mon, 16 Dec 2002 10:49:21 -0800 (PST)
Cc: [email-masked], [email-masked]

> Thanks for the pointer. I have heard that the IP ID field is used for 
> covert channel by hackers. Apparently a rogue SSL implementation was 
> leaking session keys in the IP ID field. While not foolproof or the 
> ultimate defense, if I don't need to use the IP ID field for IP 
> datagrams with the don't fragment bit set (mostly TCP), then it may be 
> useful as an intrusion detection technique.
 
I'd be very careful fixing the IP ID - I have been told by one major
"interconnect" vendor that some of their products have ways to allow
the customer (at customers persistent request) to cause the devices to
ignore and clear the DF bit...
 
rick jones

------- End of Forwarded Message

---

From: Joe Touch <[email-masked]>
Date: Wed, 18 Dec 2002 08:22:23 -0800

> ignore and clear the DF bit...

That would be a violation of the STDs (1812, 791), which could cause 
problems that would be very difficult to debug (e.g., path MTU, etc.)

I.e., you're worried about changing the IP ID field because vendors who 
violate standards will break? Go right ahead, IMO.

Laws for the lawless are a waste of effort (shades of NAT).

Joe