3 ms·
This is really great: > it’s not even recognized by Wireshark and other systems...It’s even harder to look for these kind of packet in tools like tcpdump...In
by gumby 3y ago
This is really great:
> it’s not even recognized by Wireshark and other systems...It’s even harder to look for these kind of packet in tools like tcpdump...In FreeBSD someone actually did the work and made it a option for your IP stack link however the patch was only in FreeBSD for around 24 hours before being reverted link
Basically this provides a literally covert channel through which you can undetectably smuggle data between cooperating hosts. Lovely!
- geraldcombs 3y agoI wonder which version of Wireshark he was using; we've supported the evil bit since 2009.
- TechBro8615 3y agoI mean, you could set any other non-standard bit in the header and get the same "covert channel." There's nothing special about this bit aside from the fact that some middleboxes will drop packets that have it set (which makes it an unreliable channel and thus a particularly bad candidate for data exfiltration), and some monitoring tools will parse it. Whereas if you chose any other non-standard bit, you can guarantee no monitoring tools will know how to parse it, and it's unlikely any middleboxes will drop it (unless they're dropping any packet with non-standard bits in the header).