1
I'm doing a bit of research on the methods of generating the ID field of the IP headers.
I have read the sources and other documents and have confirmed that Linux generates a random number for every peer (IP) it communicates with, and then it increments the ID by 1 for subsequent IP packets it sends to that peer.
My question is, do you know the reasons/methods behind this behavior? Why track the peers the kernel has talked to (with the memory and CPU time needed for all that stuff)?
I have started this research because I'm playing a bit with idle scan techniques.
References with more detail are preferred.
I believe that port numbers provide the disambiguation that you are talking about. – Scott – 2013-03-21T18:58:33.107
@Scott - You might have multiple conversations to the same peer/server open at the same time, on the same port. For example, 2 (or more) SSH sessions open on the same server using the same port number (default-port 22), or 2 (or more) browser windows/tabs open on the same server also using the same port number (default-port 80), at the same time. – Kevin Fegan – 2013-03-21T19:22:21.900
Yes, but they will *always* have different port numbers on the client side. (You know, those numbers above 1000 that the OS assigns automatically.) – Scott – 2013-03-21T19:32:21.827