0

In a book by Forouzan (https://www.amazon.com/Data-Communications-Networking-McGraw-Hill-Forouzan/dp/0072967757) I've read that the sequence number of the authentication header doesn't get repeated even if a packet is retransmitted.

If the sequence number is not repeated then I could potentially keep on sending same packets and receiver will think that they are different because they have different sequence numbers.

How does that prevent replay attack?

| improve this question | |
  • What protocol are we talking about and who or what is forouzan? – user36472 Aug 23 '17 at 17:11
  • Check the edit. It's a famous book so I thought people would know that. – Zephyr Aug 23 '17 at 17:13
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin♦ Feb 19 '18 at 17:47
3

The IPSec AH sequence number should not be confused with the TCP sequence number. They operate at different protocol layers.

If a host receives two packets with same AH signature (same sequence number) it definitely indicates a replay, and was not sent by the source host.

| improve this answer | |
  • But how will same packets get same sequence no as they don't get repeated ? – Zephyr Aug 25 '17 at 14:21
  • @Zephyr: You're saying they don't normally get repeated. But the point of replay protection is to guard against third parties maliciously doing so. – user1686 Sep 11 '17 at 7:02
  • @grawity, sorry I didn't get you. In the book it was given that sequence number don't get repeated . So I can keep on sending packets with different sequence number(replay attack). Now, how will receiver identify that I am doing replay attack because all the sequence no's are different and it will not be able to compare the sequence number of real and fradulent ones. – Zephyr Sep 11 '17 at 12:14
  • 1
    @Zephyr: Isn't the sequence number authenticated by AH? That would mean you cannot fake the seq# without knowing the key. – user1686 Sep 11 '17 at 12:21
  • 1
    Because the IP/IPsec layer does not know the difference. Retransmits only exist at a higher layer (i.e. TCP), so as far as the IP layer is concerned, they're no different from brand new packets. – user1686 Sep 11 '17 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.