3

What will happen in following situation?

There is a server.

  1. User A communicates with server.
  2. User B(malicious) knows IP address of User A. He sends TCP packet with User's A IP written to it, and sequence number 4294967295(maximum 32 bit value).

Will it change/broke connection state with User A on the server?

  • Just a quick note that the malicious user must know SRC IP/SRC port and DST IP/DST port to interrupt the connection as well as the currently active window of sequence numbers. Just the IP addresses are not enough. – Luke Klimasauskas Jun 26 '16 at 20:56
4

most likely the sequence number is outside the valid window for the connection, and is simply dropped by the receiver.

If it happens to be in-window, then the receiver will treat it as valid data from A. TCP is insecure and un-authenticated. Its not hard to get it in-window with enough tries.

You can and should 'fix' this by running an authentication protocol like TLS on top of the TCP stream, or just use an authenticated transport like QUIC where the packet would never be accepted without knowing A's secret keying material.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.