Skip to content

04-02: Exercises

Question

An off-path attacker has been probing a vulnerable server and recorded the Initial Sequence Number (ISN) the server chose for each of four separate connections, along with the time of each connection attempt:

Connection # Time ISN issued by server
1 T+0s 1,000,000
2 T+1s 1,064,000
3 T+2s 1,128,000
4 T+3s 1,192,000
  1. What pattern governs the server's ISN generation?
  2. Predict the ISN the server will issue for a 5th connection at T+4s.
  3. Explain how this predictability could enable a blind spoofing / session hijacking attack.
  4. Why do modern operating systems avoid this scheme?

Solution

Step 1: Find the pattern

Look at the difference between consecutive ISNs:

  • Connection 2 − Connection 1 = 1,064,000 − 1,000,000 = 64,000
  • Connection 3 − Connection 2 = 1,128,000 − 1,064,000 = 64,000
  • Connection 4 − Connection 3 = 1,192,000 − 1,128,000 = 64,000

The ISN increases by a fixed increment of 64,000 per second (a classic legacy behavior: many old TCP stacks incremented a global ISN counter by a constant amount per unit time, regardless of which client connected).

👉 (1) Pattern: ISN(t) = 1,000,000 + 64,000 × t, i.e., a linear increment of 64,000 every second, independent of the source of the connection.

Step 2: Predict the next ISN

For the 5th connection at T+4s:

ISN = 1,000,000 + 64,000 × 4 = 1,000,000 + 256,000 = 1,256,000

(Equivalently: just add 64,000 to the last observed value: 1,192,000 + 64,000 = 1,256,000.)

👉 (2) Predicted ISN at T+4s = 1,256,000

Step 3: How this enables blind spoofing / session hijacking

Normally, an attacker who cannot see the server's replies (an off-path attacker, e.g., not sitting on the network path between client and server) can't complete a TCP handshake with a spoofed source IP, because they never see the SYN-ACK containing the server's true ISN — and without it, they cannot craft a valid final ACK or subsequent data packets, since TCP receivers only accept segments whose SEQ/ACK numbers fall within the expected window.

If the ISN is predictable, this protection collapses:

  1. The attacker connects once (or observes a recent legitimate connection) to learn the current ISN and the increment rate/timing.
  2. The attacker calculates what ISN the server will assign to the next connection, at a chosen future time.
  3. The attacker sends a SYN with a spoofed source IP (pretending to be a trusted host, e.g., a client with an existing trust relationship).
  4. The server replies with SYN-ACK to the real trusted host (not the attacker) — the attacker never sees this packet.
  5. Because the attacker already predicted the ISN, it can still forge the final ACK (and subsequent data) with the correct SEQ/ACK numbers without ever seeing the SYN-ACK, completing a blind handshake.
  6. This lets the attacker inject data, hijack a session, or impersonate a trusted host to bypass IP-based authentication — all without needing to intercept any traffic.

👉 (3) Predictable ISNs let an attacker forge valid SEQ/ACK numbers for a spoofed connection without ever observing the server's real response, enabling blind connection spoofing and session hijacking against IP-trust-based services.

Step 4: Why modern systems avoid this

Modern operating systems generate ISNs using cryptographically random or hashed values (RFC 6528 and successors), typically combining a secure pseudo-random number generator with a hash of the connection's 4-tuple (source/destination IP and port) and a secret key. This ensures:

  • ISNs cannot be predicted from previous observations, even by an attacker who has opened many connections.
  • Each connection gets an ISN unrelated to others, defeating the "observe the pattern, predict the next value" strategy shown above.

👉 (4) Randomized/hashed ISN generation removes the predictable relationship between successive connections, closing off blind spoofing attacks that rely on guessing sequence numbers.

Final Answer

  1. Pattern: ISN increases by a fixed 64,000 per second — ISN(t) = 1,000,000 + 64,000t.
  2. Predicted 5th ISN (T+4s) = 1,256,000.
  3. A predictable ISN lets an off-path attacker forge a spoofed connection's SEQ/ACK numbers without seeing the server's SYN-ACK, enabling blind session hijacking/spoofing against hosts that trust source IPs.
  4. Modern systems use randomized/cryptographically-derived ISNs (RFC 6528+) specifically to prevent this kind of prediction.