I may be the only evil bit user on the internet
blog.benjojo.co.uk
I may be the only evil bit user on the internet
1–10 of 39 posts
Re: I may be the only evil bit user on the internet
#2I yearn for a world in which that RFC were viable.
I love that anyone's implemented it at all though, and I really hope it's deliberate on the part of the people who drop the packet.
Re: I may be the only evil bit user on the internet
#3In 1990 Bergen LUG implemented TCP over Avian Carriers. http://www.blug.linux.no/rfc1149/ The ping over that link was not good http://www.blug.linux.no/rfc1149/pinglogg/
Re: I may be the only evil bit user on the internet
#4The "security by obscurity" bit is interesting. I'm now imagining a server where it checks that the initial sequence number of the SYN packet ends with your current OATH two-factor authentication code, or something, and it drops the packet if you have the wrong code. (Which elevates it quite a bit past simply "obscurity.") The traffic is indistinguishable from normal SSH traffic, and there's very little code that has to process anything from untrusted sources.
Re: I may be the only evil bit user on the internet
#5What's going on here, exactly?
Re: I may be the only evil bit user on the internet
#6What's going on here, exactly?
Author modified his OS kernel to set the "Evil Bit" (as proposed in RFC3514) on every TCP Packet Header. Having scanned the Alexa 100K, the author found that some servers actually followed RFC3514 and dropped traffic with the Evil bit set.
Re: I may be the only evil bit user on the internet
#7In 1990 Bergen LUG implemented TCP over Avian Carriers. http://www.blug.linux.no/rfc1149/ The ping over that link was not good http://www.blug.linux.no/rfc1149/pinglogg/
The RFC is from 1990, the implementation from 2001.
Re: I may be the only evil bit user on the internet
#8While a very good story, I suspect the offending firewalls might drop traffic with any of the reserved bits set, not just the "evil" bit. Very fun exercise though!
Re: I may be the only evil bit user on the internet
#9While a very good story, I suspect the offending firewalls might drop traffic with any of the reserved bits set, not just the "evil" bit. Very fun exercise though!
This seems like a really bad thing to do. If any of those reserved bits get used for a legitimate purpose in the future then none of these networks will be accessible. Reserved should mean "set to 0 when you send, ignore on when you receive". It's not like these bits actually cost any additional processing. There's literally no benefit to dropping these packets, and it's shenanigans like this that mean we can't improve protocols easily in the future.
I wonder how many routers are filtering IPv4 packets with fragment offsets of 8190 and 8191?
Re: I may be the only evil bit user on the internet
#10[deleted]