RFC 4953: Defending TCP Against Spoofing Attacks
In plain English — editorial summary, not part of the RFC
Recent analysis of potential attacks on core Internet infrastructure indicates an increased vulnerability of TCP connections to spurious resets (RSTs), sent with forged IP source addresses (spoofing). TCP has always been susceptible to such RST spoofing attacks, which were indirectly protected by checking that the RST sequence number was inside the current receive window, as well as via the obfuscation of TCP endpoint and port numbers. For pairs of well-known endpoints often over predictable port pairs, such as BGP or between web servers and well-known large-scale caches, increases in the path bandwidth-delay product of a connection have sufficiently increased the receive window space that off-path third parties can brute-force generate a viable RST sequence number. The susceptibility to attack increases with the square of the bandwidth, and thus presents a significant vulnerability for recent high-speed networks. This document addresses this vulnerability, discussing proposed solutions at the transport level and their inherent challenges, as well as existing network level solutions and the feasibility of their deployment. This document focuses on vulnerabilities due to spoofed TCP segments, and includes a discussion of related ICMP spoofing attacks on TCP connections. This memo provides information for the Internet community.
Document record
- Document ID
- RFC4953
- Published
- July 2007
- Authors
- J. Touch
- Status
- INFORMATIONAL
- Stream
- IETF
- Area
- wit
- Pages
- 28
- Also known as
- —
Topics
Related documents
Ranked automatically by shared keywords, IETF area and stream — not by editorial selection.
- RFC 5961Improving TCP's Robustness to Blind In-Window AttacksUpdated
August 2010
- RFC 4992XML Pipelining with Chunks for the Internet Registry Information ServiceUpdated
August 2007
- RFC 4173Bootstrapping Clients using the Internet Small Computer System Interface (iSCSI) ProtocolUpdated
September 2005
- RFC 4172iFCP - A Protocol for Internet Fibre Channel Storage NetworkingUpdated
September 2005
- RFC 4960Stream Control Transmission ProtocolObsoleted
September 2007
- RFC 4923Quality of Service (QoS) Signaling in a Nested Virtual Private NetworkCurrent
August 2007
- RFC 4987TCP SYN Flooding Attacks and Common MitigationsCurrent
August 2007
- RFC 4898TCP Extended Statistics MIBCurrent
May 2007
Also filed under
About this page
The document record above — title, authors, date, status, stream, area, relationships, DOI and errata — is imported verbatim from the public RFC Editor index. The “in plain English” section is editorial: written by The metasystema editorial team, not part of the RFC. Where the two differ, the RFC text governs.
Last checked against the RFC Editor index on . RFCs are never revised after publication; changes are issued as new documents.
Data sources · Editorial policy · Report a correction · What is an RFC?