Has anyone ever seen TCP RST packets being sent from clients to web
server with a "Reset Cause" containing the HTML that was in the packet
that they are responding to?
For example a browser client is getting a 404 error returned from my
webserver but right after this I am seeing a CP ACK/RST packet from
the client with the 404 HTML in the packet.
When I look at the packet in Ethereal it shows the HTML in a field
called "Reset cause".
These packets are causing my IDS to go nuts.
It was an old HP/UX (I think it was HP/UX anyway) trick to stick the
reason for the reset into the packet itself. That is why ethereal is
calling it that. The "reset clause" was picked up for awhile in some
older firewalls but it has really been forgotten about in anything new.
Now the client is probably just inverting the 404 packet into a reset.
It is an old TCP stack trick to send a reset without having to allocate
a new packet. Instead you just modify the packet in place to turn it
into a reset: swap the sequence and the ACK numbers, the ports and the
IP addresses, then you set TH_RST flag and finally fixup the checksums.
Send the packet back through the routing table or flip the MAC addrs and
send it back out the incoming interface.
You would have to provide much more detail about the client to guess at
why it is sending a reset. My blind guess is that the client is a
http scanner/fingerprinter/ping that uses raw sockets instead of the
host TCP stack. It is tearing down the connection once it got the
response back.
Should the IDS be looking at the data in the ACK/RST packet?
Unfortunately yes unless it has a fingerprint of the server and knows
how the TCP stack is going to handle the excess data. It could be used
as a vector to attack the logging subsystem.
Pardon any misspelling, I'm exhausted.
.mike
frantzen@(nfr.com | cvs.openbsd.org | w4g.org)
PGP: CC A4 E2 E8 0C F8 42 F0 BC 26 85 5B 6F 9E ED 28
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
