accidental knowledge

Stefan Savage (savage@cs.washington.edu)
Mon, 4 Jan 1999 16:46:51 -0800

Suppose you have two boxes, A and B...
Suppose they're having a TCP conversation.
Suppose the last sequence number sent from A is N-1.
Now A is about to sent a FIN with sequence number N.

Just before this happens, suppose some third party C spoofs a packet
from A to B with sequence number N+1.

loop:

Now A sends its FIN with sequence number N.
B responds by acking N+1 (well really N+2, but that's being
pedantic)
That wasn't the corresponding FIN that A was expecting, so...
goto loop

At this point I had to unplug my machine from the Ethernet.

For what its worth, I've only witnessed this between a Digital Unix
sender (spinoza) and a Linux receiver (sirpa-a)

- Stefan