Is that true. You need monotonically increasing sequence space. We'd need to
make the MD5 part a small fragment of the sequence space (say 24bit) I
think ?
This idea isn't mine; it's actually Steve Bellovin's. The idea is that
each (local port, remote port, remote address) needs to have an
monotonically increasing sequence space. This is to prevent packets
from an old TCP connection from getting accepted as part of the new TCP
connection. However, there's no reason that two unrelated (local port,
remote port) sequences should have the same increasing sequence number
space. Hence, the kernel still keeps an initial seuquence number
counter, but for each (local port, remote port, remote address), you add
a 32 bit value which is derived by taking the MD5 of the above tuple
plus some initial random secret.
- Ted