1

Let's say an attacker gets the sequence number between me and my client. Now he continues the conversation with me and has changed the IP address.

How do I prevent packages from being sent to addresses that do not match the IP of the initial request/tcp message. Is there a setting in the router/windows or do I need to write my own tcp/ip program

Feels like the protocol should have had a flag/option for this already.

Improve this question
4
  • 5
    You cannot change any of the source or destination IP or TCP addresses in a TCP connection.
    – Ron Maupin ♦
    Jun 8, 2020 at 14:01
  • So if the has the sequence number he can just continue the conversation? Seems easy.
    – Arre
    Jun 8, 2020 at 14:05
  • 6
    No, if any of the IP address (or TCP port) is changed, then this is no more the same TCP connection. The attacker would have to spoof the original IP address, and contrary to what TV series show, this is not this easy.
    – JFL
    Jun 8, 2020 at 14:10
  • 1
    See RFC 793, Transmission Control Protocol, which is the definition of TCP: "To allow for many processes within a single Host to use TCP communication facilities simultaneously, the TCP provides a set of addresses or ports within each host. Concatenated with the network and host addresses from the internet communication layer, this forms a socket. A pair of sockets uniquely identifies each connection." Changing any one of the addresses will break the connection.
    – Ron Maupin ♦
    Jun 8, 2020 at 14:19

2 Answers 2

Reset to default
6

The endpoints of TCP connections are instantiated in software through a construct known as a socket. An instance of a TCP socket is defined by the source IP address, source port number, destination address and destination port number.

If any of these parameters change (e.g., a packet arrives with a different source address), then then the software will reject the data, since it is, by definition, a different socket.

Improve this answer
10
  • "If any of these parameters change (e.g., a packet arrives with a different source address), then then the software will reject the data, since it is, by definition, a different socket." So after the handshake is complete (connection established), an attacker can send an http request with the client's address(as source) and make results come back that were not requested by the real client?
    – Arre
    Jun 8, 2020 at 14:47
  • 1
    Event if the attacker can change it's source address that doesn't mean the response will be routed to him. The response will likely arrive at the original host, not the attacker (depending on where they are in the network); also this doesn't take into account https.
    – JFL
    Jun 8, 2020 at 15:03
  • 1
    If you can see the full 3way handshake, and you are in a position to impersonate one end, it's possible to assume the endpoint. Neither part is easy to pull off. (30 years ago this was easier because everything was on hubs and everyone could see everyone else's traffic.)
    – Ricky
    Jun 8, 2020 at 15:10
  • @JFL No, but let's say that there is a client who visits a porn page and requests categories that are considered "normal" / mature. Now an attacker can use the client's IP to request child porn that the client does not want to be associated with. There are worse scenarios, but ISPs should have the rights to control the source ip in a tcp message so that it matches the device that sent it. At least that's a start
    – Arre
    Jun 8, 2020 at 15:36
  • @RickyBeam It's enough that the handshake is done? Then the connection is opened for a while (waits for ip packets) and you can send ip packages freely (with klient as source ip)
    – Arre
    Jun 8, 2020 at 15:38
0

Let's say an attacker gets the sequence number between me and my client.

Sequence numbers should be initialized with good randomization.

Now he continues the conversation with me and has changed the IP address.

That should not be possible and if it is, the host is broken. Vulnerable hosts should never be connected/exposed to the Internet and should be replaced asap.

The sequence number must be interpreted specific to the socket in question (tuple of source IP/destination IP/source port/destination port). Different sockets must be able to use the sequence numbers independently.

Random sequence number initialization is still important since an attacker being able to guess port numbers and sequence numbers could spoof the source IP address and then insert data into an unencrypted connection or break it for a DoS attack.

How do I prevent packages from being sent to addresses that do not match the IP of the initial request/tcp message.

A stateful firewall is the usual measure to prevent things like that.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.