OpenBSD Journal

scrub on $if reassemble tcp

Contributed by jose on from the fix-up-TCP dept.

tom hensel writes: "reading through the manpage of pf.conf i stumbled upon a interesting option for scrub rules i haven't noticed yet.

     reassemble tcp
           Statefully normalizes TCP connections.  scrub reassemble tcp rules
           may not have the direction (in/out) specified.  reassemble tcp per-
           forms the following normalizations:

           ttl      Neither side of the connection is allowed to reduce their
                    IP TTL.  An attacker may send a packet such that it reach-
                    es the firewall, affects the firewall state, and expires
                    before reaching the destination host.  reassemble tcp will
                    raise the TTL of all packets back up to the highest value
                    seen on the connection.
           timeout modulation
                    Modern TCP stacks will send a timestamp on every TCP pack-
                    et and echo the other endpoint's timestamp back to them.
                    Many operating systems will merely start the timestamp at
                    zero when first booted, and increment it several times a
                    second.  The uptime of the host can be deduced by reading
                    the timestamp and multiplying by a constant.  Also observ-
                    ing several different timestamps can be used to count
                    hosts behind a NAT device.  And spoofing TCP packets into
                    a connection requires knowing or guessing valid times-
                    tamps.  Timestamps merely need to be monotonically in-
                    creasing and not derived off a guessable base time.
                    reassemble tcp will cause scrub to modulate the TCP times-
                    tamps with a random number.

this was added to 3.4, reads:
More TCP scrubbing: Modulate TCP timestamps to frustrate NAT detection and prevent remote uptime guesses. New scrub option 'reassemble tcp'.
on my home gateway this rule does the job:

scrub on $tun_if random-id reassemble tcp

all about scrub rules can be read in the manpage: pf.conf(5) "

(Comments are closed)

  1. By Foxy () on

    Modify TCP timestamps with PF allows to defeat Nmap uptime detection by fingerprinting : see details on

    2 others papers on NAT detection (based on IP ID) :


Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]