From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754800AbaEOIYD (ORCPT ); Thu, 15 May 2014 04:24:03 -0400 Received: from smtp.sgsi.ucl.ac.be ([130.104.5.67]:35339 "EHLO smtp6.sgsi.ucl.ac.be" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754556AbaEOIYA (ORCPT ); Thu, 15 May 2014 04:24:00 -0400 X-DKIM: Sendmail DKIM Filter v2.8.3 smtp6.sgsi.ucl.ac.be 72078183433 Date: Thu, 15 May 2014 10:23:50 +0200 From: Christoph Paasch To: Julian Kirsch Cc: "netdev@vger.kernel.org" , "linux-kernel@vger.kernel.org" , Christian Grothoff Subject: Re: Collecting data to demonstrate TCP ISN-based port knocking Message-ID: <20140515082350.GC5287@cpaasch-mac> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-Sgsi-Spamcheck: SASL authenticated, X-SGSI-MailScanner-ID: 72078183433.A9F09 X-SGSI-MailScanner: Found to be clean X-SGSI-From: christoph.paasch@uclouvain.be X-SGSI-Spam-Status: No Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, On 14/05/14 - 21:55:36, Julian Kirsch wrote: > some of you might remember the proposal of a patch which implements a > variant of port-knocking that can be used to check the authenticity of > arbitrary TCP connections and even can do integrity checking of TCP > payload data by using a pre-shared key [0]. This patch, as well as a > research paper describing its inner workings are available on > gnunet.org under the name "Knock" [1]. > > As Knock uses two fields in the TCP header in order to hide > information and we explicitly want to be compatible with machines > sitting in typical home networks, we need to make sure that this > information doesn't get corrupted by the majority of NAT boxes out > there. The lack of hard data on this also was one of the objections > when the patch was submitted last time. We thus created a program > which tests if Knock could work in your environment. It would be > greatly appreciated if some of you were able to execute the program on > their machines in order to help us to get an estimation of if Knock > one day could be used in a large scale. have you looked at http://www.eecs.berkeley.edu/~sylvia/cs268-2014/papers/deploytcp-imc11.pdf ? Michio started a second larger measurement campaign 2 years ago. You might ask him if he has more data now. Cheers, Christoph