Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Routers operate on the Internet Protocol layer (level 3), which have no state (or anything considered a duplicate). TCP is a layer above (level 4) and that has sequence ids.


I'm skeptical that there is no infrastructure in place to prevent this, but if you're right, it really should be possible to make a home router plugin (for, say, OpenWRT) to detect this spoofing. This plugin could then be used to gather data on how prevalent this attack is, which would be quite interesting. Because as I see it, there is really no reason to believe this is just used for Tor exclusively.


It's easily detectable. You could put a firewall rule to mark it and log it to syslog as this can happen at the kernel level. You will although get lots of false positives as you get duplicate sequence ids anyway in the normal course of things as things timeout and resend connections they think are lost.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: