From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id ; Sat, 27 Jan 2001 21:16:56 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id ; Sat, 27 Jan 2001 21:16:47 -0500 Received: from shell.cyberus.ca ([209.195.95.7]:51381 "EHLO shell.cyberus.ca") by vger.kernel.org with ESMTP id ; Sat, 27 Jan 2001 21:16:42 -0500 Date: Sat, 27 Jan 2001 21:15:48 -0500 (EST) From: jamal To: Chris Wedgwood cc: , Subject: Re: ECN: Clearing the air In-Reply-To: <20010128150813.A1595@metastasis.f00f.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org On Sun, 28 Jan 2001, Chris Wedgwood wrote: > On Sat, Jan 27, 2001 at 07:23:51PM -0500, jamal wrote: > > suggested blocking ECN. Article at: > > http://www.securityfocus.com/frames/?focus=ids&content=/focus/ids/articles/portscan.html > > the site is now ATM -- can someone briefly explain the logic in > blocking it? > It is Queso they quoted not nmap, sorry -- same thing. The idea is to "detect" port scanners. Queso sets the two TCP reserved bits in the SYN (now allocated for ECN). Some OSes reflect that back in the SYN-ACK (Linux < 2.0.2? for example was such a culprit). Queso could then use that information to narow down the OS detection. I suppose the idea is to detect Queso and react to it ;-> cheers, jamal - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org Please read the FAQ at http://www.tux.org/lkml/