next up previous contents
Next: Flexresp Up: Active Response Previous: Enabling Active Response   Contents

Configure Sniping

Configure the number of attempts to land a TCP RST within the session's current window (so that it is accepted by the receiving TCP). This sequence "strafing" is really only useful in passive mode. In inline mode the reset is put straight into the stream in lieu of the triggering packet so strafing is not necessary.

Each attempt (sent in rapid succession) has a different sequence number. Each active response will actually cause this number of TCP resets to be sent. TCP data (sent for react) is multiplied similarly. At most 1 ICMP unreachable is sent, if and only if attempts $>$ 0.

    ./configure --enable-active-response

    config response: [device <dev>] [dst_mac <MAC address>] attempts <att>

    <dev> ::= ip | eth0 | etc.
    <att> ::= (1..20)
    <MAC address> ::= nn:nn:nn:nn:nn:nn    
     (n is a hex number from 0-F)

device ip will perform network layer injection. It is probably a better choice to specify an interface and avoid kernel routing tables, etc.

dst_mac will change response destination MAC address, if the device is eth0, eth1, eth2 etc. Otherwise, response destination MAC address is derived from packet. Example:

    config response: device eth0 dst_mac 00:06:76:DD:5F:E3 attempts 2



Eugene Misnik 2013-05-08