RE: tcp options denial of services.

Example of packet-of-death:

0x0000:  4500 0030 1234 4000 ff06 e83f c0a8 0001
0x0010:  c0a8 0002 0400 1000 0000 0064 0000 0064
0x0020:  7000 0fa0 dc6a 0000 0204 05b4 0101 04fd

I believe the final octet in the packet, 0xfd (bin 253) is the key here.
I believe this octet is the length field of the TCP SACK option. This
value needs to be greater than 0x7f (bin 127) to exploit the
vulnerability described in your link.

Should be able to create one of these with a packet generator such as
packETH:

http://packeth.sourceforge.net/

or edit an existing packet with a packet editor such as Netdude:

http://netdude.sourceforge.net/


Joe Forjette
Security Engineer
Crossbeam Systems

-----Original Message-----
From: Jorge Alfredo Garcia [mailto:frederix@gmail.com] 
Sent: Thursday, May 26, 2005 10:50 AM
To: firewalls@securityfocus.com
Subject: tcp options denial of services.

hello list i am trying to test the netfilter security advisory
2004-06-30-2.6-tcpoption.
(http://www.netfilter.org/security/2004-06-30-2.6-tcpoption.html).
I dont know how to generate the "packet of dead" for testing.
Any idea?
Thanx in advance.