Basic Mechanics
Idle scans take advantage of predictable Identification field value from IP header: every IP packet from a given source has an ID that uniquely identifies fragments of an original IP datagram; the protocol implementation assigns values to this mandatory field generally by a fixed value (1) increment. Because transmitted packets are numbered in a sequence you can say how many packets are transmitted between two packets that you receive.
An attacker would first scan for a host with a sequential and predictable sequence number (IPID). The latest versions of Linux, Solaris, OpenBSD, and Windows Vista are not suitable as zombie, since the IPID has been implemented with patches that randomized the IP ID. Computers chosen to be used in this stage are known as "zombies".
Once a suitable zombie is found the next step would be to try to establish a TCP connection with a given service (port) of the target system, impersonating the zombie. It is done by sending a SYN packet to the target computer, spoofing the IP address from the zombie, i.e. with the source address equal to zombie IP address.
If the port of the target computer is open it will accept the connection for the service, responding with a SYN/ACK packet back to the zombie.
The zombie computer will then send a RST packet to the target computer (to reset the connection) because it did not actually send the SYN packet in the first place.
Since the zombie had to send the RST packet it will increment its IPID. This is how an attacker would find out if the targets port is open. The attacker will send another packet to the zombie. If the IPID is incremented only by a step then the attacker would know that the particular port is closed.
The method assumes that zombie has no other interactions: if there is any message sent for other reasons between the first interaction of the attacker with the zombie and the second interaction other than RST message, there will be a false positive.
Read more about this topic: Idle Scan
Famous quotes containing the words basic and/or mechanics:
“The basic test of freedom is perhaps less in what we are free to do than in what we are free not to do. It is the freedom to refrain, withdraw and abstain which makes a totalitarian regime impossible.”
—Eric Hoffer (1902–1983)
“the moderate Aristotelian city
Of darning and the Eight-Fifteen, where Euclid’s geometry
And Newton’s mechanics would account for our experience,
And the kitchen table exists because I scrub it.”
—W.H. (Wystan Hugh)