5 ms·
So is it only the byte at 0x47f that matters? Could you just send a packet filled with 0x32 0x32 0x32 0x32 0x32 to trigger this? (Like, download a file full of
by 0x0 14y ago
So is it only the byte at 0x47f that matters? Could you just send a packet filled with 0x32 0x32 0x32 0x32 0x32 to trigger this? (Like, download a file full of 0x32s?) Or does it have to look like a SIP packet?
You'd think the odds of getting a packet with 0x32 in position 0x47f is almost 1/256 per packet? So why aren't these network cards falling over everywhere every few seconds?
- wvenable 14y agoProbably because there is a 2/256 chance of getting sent the inoculation value. But it's a good question.
- caf 14y agoLater in the article it states that any value other than 0x31, 0x32 or 0x33 acts as an "inoculation value", so that would be a 253/256 chance for each packet of at least 1151 bytes.
- jes5199 14y agois 1151 an unusually large packet? Because otherwise how are these NICs not getting inoculated as soon as they're online?
- caf 14y agoIt depends on what the server is doing - packets that size wouldn't be unusual in a bulk data transfer (like a HTTP response) but are larger than you'd see in the typical DNS query/response.
- deleted 14y ago[deleted]