Well, of the three mitigations suggested in the article: 1 - Random NAT port allocation Seems like the answer is "not by default." According to iptables(8), S

Well, of the three mitigations suggested in the article: 1 - Random NAT port allocation Seems like the answer is "not by default." According to iptables(8), SNAT defaults to using the pre-translated ports whenever possible, so it's up to the connecting client (victim's TCP stack) to randomly select source ports. There is a "--to-ports" option that lets you limit the usable source ports, but it's not mentioned how the ports are selected in that case. 2 - Reverse Path Validation I'm not really sure how this helps in the described situation. If the attacker and the victim are on the same wifi access point, then both of their traffic will be sourced from the same network interface, so even strict RFC 3704 validation will pass for spoofed packets from the attacker. But for completeness, you can turn that on by setting a sysctl (rp_filter = 1). 3 - TCP window checking I _believe_ that the vanilla linux kernel does check this by default, as the mentioned adjustments to OpenWRT seem to be removing a non-standard option to disable the TCP window checking https://github.com/openwrt/openwrt/commit/75e78bcaab847557ce1782eb2dea9dff9a029171 https://github.com/openwrt/openwrt/commit/75e78bcaab847557ce...