News for hackers. Stuff that matters.

A comment on Show HN: Knockles – eBPF Port Knocking Tool. Parent comment

Re:Show HN: Knockles – eBPF Port Knocking Tool by nousermane on Monday August 29, 2022 @03:05PM (#32642166)
Clever, yes. But this will break in presence of middle-boxen that rewrite IP-ID [1] and/or TCP-SEQ/ACK [2] numbers (SSL inspection firewalls, WAN optimizers, older satellite modems, even some particularly bad carrier-grade NAT devices).

[1] https://en.wikipedia.org/wiki/IPv4#Identification

[2] https://en.wikipedia.org/wiki/Transmission_Control_Protocol#...

[ Parent | on HN ]
Re:Show HN: Knockles – eBPF Port Knocking Tool by cryptonector on Monday August 29, 2022 @03:52PM (#32642731)
Yes, putting the HMAC in the IP ID field is brittle.

Maybe a TCP option could be used.

[ Parent | on HN ]