Skip to content

04-03: Exercises

Question

An attacker wants to forcibly reset an active TCP connection between a client and server using a forged RST packet. Through reconnaissance, the attacker has learned the connection's 4-tuple:

  • Source IP: 203.0.113.5 (client)
  • Source Port: 51422
  • Destination IP: 198.51.100.10 (server)
  • Destination Port: 443

The attacker does not know the exact current sequence number, but knows the server's receive window size is 65,536 bytes.

  1. What fields must the forged RST packet match exactly to be accepted by the receiving TCP stack?
  2. Within what range of sequence numbers will a guessed RST be accepted (given the receive window)?
  3. Roughly how many forged packets would the attacker need to send to guarantee hitting a valid sequence number in that window?
  4. Why does a larger receive window make this attack easier?

Solution

Step 1: Fields the forged RST must match

For a receiving TCP stack to accept a RST and tear down the connection, the packet must match the connection's identifying fields exactly, plus fall within an acceptable sequence range:

  • Source IP (spoofed to match the real sender, e.g., the client's 203.0.113.5)
  • Source Port (51422)
  • Destination IP (198.51.100.10)
  • Destination Port (443)
  • RST flag set
  • Sequence number — must fall within the receiver's currently acceptable window (it does not need to be the exact next-expected byte, only "in-window," per RFC 793/5961 behavior)

👉 (1) The forged RST must match the full 4-tuple (source IP, source port, destination IP, destination port) exactly, and carry a sequence number that falls inside the current receive window.

Step 2: The acceptable sequence number range

TCP does not require a RST's sequence number to match exactly — it only needs to land within the current receive window to be accepted (this "window validation" was actually intended as a security improvement over requiring an exact match, but it inadvertently makes brute-forcing easier since the attacker no longer needs the exact number).

Given a receive window of 65,536 bytes, and assuming the true next-expected sequence number is somewhere the attacker doesn't precisely know, the acceptable range spans:

Window size = 65,536 sequence numbers wide (any value from the current expected SEQ up to expected SEQ + window size − 1 will be accepted)

👉 (2) The acceptable range is 65,536 consecutive sequence numbers wide (one full receive window).

Step 3: Number of attempts needed to brute-force it

The full sequence number space is 32 bits: 2³² = 4,294,967,296 possible values.

If the attacker sends RSTs with sequence numbers spread evenly across the entire space, each guess "covers" a window of 65,536 possible in-window values around it. So the number of guesses needed to guarantee at least one falls in the true acceptable window is:

Number of attempts = Total sequence space ÷ Window size = 4,294,967,296 ÷ 65,536 = 65,536 attempts

(This is because 2³² ÷ 2¹⁶ = 2¹⁶ = 65,536 — spacing guesses exactly one window-width apart guarantees full coverage of the sequence space.)

👉 (3) Roughly 65,536 forged RST packets, spaced one window-width apart across the full 32-bit sequence space, guarantee at least one falls inside the acceptable range.

Step 4: Why a larger window helps the attacker

The receive window defines how many consecutive sequence numbers will be accepted as "in range" without needing an exact match. Since:

Attempts needed = 2³² ÷ Window size

A larger window size directly reduces the number of guesses required — doubling the window halves the number of attempts needed. Modern high-throughput/high-bandwidth-delay-product connections often use large windows (via TCP window scaling) to improve performance, which unfortunately widens the "acceptable" range for a blind attacker and makes brute-force RST injection significantly cheaper.

👉 (4) A larger window accepts a wider range of sequence numbers as valid, so fewer guesses are needed to land inside it — attempts scale inversely with window size.

Final Answer

  1. The RST must match the exact 4-tuple (source IP, source port, destination IP, destination port), and its sequence number must fall within the current receive window.
  2. Acceptable range width = the receive window size = 65,536 sequence numbers.
  3. Attempts needed ≈ 2³² ÷ 65,536 = 65,536 forged packets to guarantee a hit.
  4. A larger receive window widens the acceptable sequence-number range, which reduces the number of brute-force attempts needed — the attack gets easier as the window grows.