0

Whenever, we do a wireshark capture and Follow--> TCP Stream, we see the sequence numbers as fixed values.

enter image description here

In reality, if this were the case, the intruder can easily predict the transmission patterns.How is it actually, avoided to ensure a secure communication ?

Improve this question
  • 3
    For secure communication, SSL/TLS is required. – Zac67 Jun 22 '19 at 12:49
  • 1
    TCP does not provide secure communication. That must be handled by something else. – Ron Maupin♦ Jun 22 '19 at 14:07
  • 1
    Note that Wireshark shows relative TCP sequence numbers by default. You can disable that behavior in the TCP protocol preferences. – Gerald Combs Jun 28 '19 at 23:24
3

This is known as a TCP sequence prediction attack. There is a RFC defined to defend against it, RFC6528

In a nutshell, some vendors are responding to the threat by introducing random sequence number generation however overall participation is fairly low.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.