Re: [tcpm] [tcpinc] TCP Stealth - possible interest to the WG

[Christian Grothoff <[e-mail]>]

On 08/21/14 06:16, Joe Touch wrote:
> 
> 
> On 8/18/2014 3:07 PM, Scheffenegger, Richard wrote:
>> Hi Alfie,
>>
>> my concern is with the use of a static ISN for each 4-tuple; this
>> significantly increases the chance of a collision between sessions (ie.
>> when the sender terminates a sluggish earlier session, some segments of
>> that last session will very likely be in-window for a session that was
>> started a short time later).
> 
> +1, and I haven't seen a satisfactory answer to this yet.
> 
> FWIW, the doc refers to TCP MD5, which has been deprecated and replaced
> by TCP-AO. TCP-AO has an experimental extension to support NAT traversal.

Well, several people seem to suggest that making the use of TSval
_mandatory_ with TCP Stealth would solve this and other concerns; so if
we put that into the draft, would you be happy?

> Additionally, responding with a TCP RST isn't the best response if
> you're trying to hide from port knocking. Silence is best in that case.

That depends on what the system does for a closed port.  The draft says
the system should react in the same way as it usually does, and usually
MY servers respond with TCP RST if the port is closed. If you usually
drop, you should drop.  If this is about hiding, the key thing is to not
change the behavior for the stealth-open port in relation to the
behavior of a closed port.