random ip id's

[supermike]

Hello, I have CONFIG_GRKERNSEC_RANDID enabled (1.9.9h)
but a scan using nessus gives the warning:
The remote host uses non-random IP IDs, that is, it is
possible to predict the next value of the ip_id field of
the ip packets sent by this host... etc.

Can someone tell me if it's false positive or how I can check that
Thanks,
Mike

[spender]

use tcpdump -vvv. It will display the IP IDs of packets you are sending out. Also, make sure you don't have the sysctl option enabled and haven't set the /proc/sys/kernel/grsecurity/rand_ip_ids value to 1.

-Brad

[supermike]

thanks, I checked and they look pretty random to me so it must be nessus reporting that incorrectly

[pappy]

[quote="supermike"]Hello, I have CONFIG_GRKERNSEC_RANDID enabled (1.9.9h)
but a scan using nessus gives the warning:
The remote host uses non-random IP IDs, that is, it is
possible to predict the next value of the ip_id field of
the ip packets sent by this host... etc.

Can someone tell me if it's false positive or how I can check that
Thanks,
Mike[/quote]

FYI, did you put the corresponding echo "1" > /proc/.../grsecurity/* into the proc filesystem to actually enable what you compiled in?

HTH,

Alex