News for hackers. Stuff that matters.

A comment on TCP Traceroute. Parent comment

Re:TCP Traceroute by majke on Sunday February 24, 2013 @10:42PM (#5277203)
Alternatively - watch out what ICMP errors are outgoing from your servers. (But don't block all ICMP or you'll screw up MTU discovery [1])

If you're worried about exposing your internal setup you also need to filter packets with unusual IP flags such as "Record Route" [2] or "Internet Timestamp" [3]. Fortunately scrub should notice that.

[1] http://en.wikipedia.org/wiki/Path_MTU_Discovery

[2] http://tools.ietf.org/html/rfc791#page-18

[3] http://tools.ietf.org/html/rfc791#page-22

If you have a source NAT on your servers, it's likely that an attacker can easily detect that, no matter ICMP / TTL / IP options setting. Running p0f on established connections will show your setup, for example:

http://seclists.org/nmap-dev/2007/q1/175

[ Parent | on HN ]
Re:TCP Traceroute by X-Istence on Monday February 25, 2013 @08:42AM (#5278919)
It becomes much harder to identify NAT when you also scrub out going packets, and change the packet IP identification field with a random-id.

Other things that help as well is to not load balance the TCP/IP connection, but rather terminate on the first machine, then pass the connection through using something like varnish/haproxy.

[ Parent | on HN ]