Question

Suppose an idle TCP connection exists between sockets A and B. A third party has eavesdropped and knows the current sequence number at both ends. (a) Suppose the third party sends A a forged packet ostensibly from B and with 100 bytes of new data. What happens? Hint: Look up in Request for Comments 793 what TCP does when it receives an ACK that is not an "acceptable ACK." (b) Suppose the third party sends each end such a forged 100-byte data packet ostensibly from the other end. What happens now? What would happen if \(\mathrm{A}\) later sent 200 bytes of data to B?

Short answer

Forged packets are discarded by TCP if sequence/ACK numbers are incorrect. Both A and B discard forged packets and correct sequence with ACKs, allowing future valid communication.

Step-by-step solution

Understanding the Problem

An idle TCP connection means there is an established connection, but no data is currently being transmitted. A third party has intercepted the sequence numbers used in this communication.

Analysis of Forged Packet Sent to A

When a forged packet is sent to A from the third party with 100 bytes of new data: - TCP at A receives the packet, checks the ACK number. - If the ACK number is out of the expected range or the sequence number does not match, TCP discards the packet and sends an ACK with the correct sequence number (Reference: RFC 793, Section 3.9).

Analysis of Forged Packet Sent to Both Ends (A and B)

When forged packets are sent to both ends: - Both A and B will independently check the sequence numbers and discover the packets are not in the expected sequence. - Both sides discard these packets and send ACKs to correct the sequence numbers.

Consequences of A Sending 200 Bytes to B

If A later sends 200 bytes of data to B: - The data packets from A will have the correct sequence number and acknowledgment number. B will correctly acknowledge the received data packets from A. - The previous forged packet is not considered in the sequence, and does not affect this valid communication.

Key concepts

TCP Sequence Numbers

In a TCP connection, sequence numbers play a critical role in ensuring data is delivered in an orderly manner. Each byte of data sent in a TCP stream is assigned a unique sequence number. When data is transmitted, the receiver acknowledges it by sending an acknowledgment (ACK) number, indicating the next expected byte. This mechanism allows TCP to handle out-of-order packets and detect packet loss efficiently.
Sequence numbers also act as a safeguard against issues like packet reordering and duplication. If a packet arrives with an unexpected sequence number, the receiver identifies it as out of sequence and discards it or stores it for reassembly later. Understanding this helps in grasping how TCP maintains reliable communication over potentially unreliable networks.

Forged Packets

A forged packet is one that appears to be sent from a legitimate source but has been crafted by an attacker. Forged packets can be used to disrupt communication or insert malicious data into a stream. In TCP, such packets can cause significant issues if they manage to deceive the receiving device into thinking they are valid.
For instance, if an attacker intercepts the sequence numbers of a TCP connection and sends a forged packet to a device (say, A) with 100 bytes of new data, TCP at A will check the packet's sequence number. If the number is out of the expected range, A will discard the packet and send an ACK with the correct sequence number to maintain the integrity of the communication. This is detailed in RFC 793, Section 3.9.
However, if such packets are sent to both ends of a TCP connection (A and B), both devices will react independently, discarding out-of-sequence packets and sending corrective ACKs. This indicates that TCP's inherent mechanisms provide robust protection against such attacks, ensuring no disruption occurs in the legitimate data flow.

TCP Acknowledgment

ACKs (acknowledgments) are a fundamental component of TCP’s reliability. When a device receives a segment, it sends an ACK back to the sender, indicating which byte it expects next (the ACK number). This feedback loop allows the sender to know which data has been successfully received and what needs retransmission in case of packet loss.
If a device receives a segment with an ACK number outside of the 'acceptable' range, it discards the segment. This process helps to identify and disregard forged packets. For instance, if device A receives a forged packet from a third party, it will verify the ACK number. If it doesn't match the expected range, the packet will be discarded and A will respond with an ACK bearing the correct sequence number.
This mechanism ensures the ongoing communication remains consistent and reliable, emphasizing the importance of sequence and acknowledgment numbers in maintaining the integrity of a TCP connection.