为什么TCP的ISN需要随机生成？

• 避免ISN预测，防止TCP Reset攻击?
  • 防范的关键是在IP层通信的加密?
• ISN的生成机制

---

下面摘抄RFC793的原文

Initial Sequence Number Selection

The protocol places no restriction on a particular connection being
used over and over again. A connection is defined by a pair of
sockets. New instances of a connection will be referred to as
incarnations of the connection. The problem that arises from this is
– “how does the TCP identify duplicate segments from previous
incarnations of the connection?” This problem becomes apparent if the
connection is being opened and closed in quick succession, or if the
connection breaks with loss of memory and is then reestablished.

To avoid confusion we must prevent segments from one incarnation of a
connection from being used while the same sequence numbers may still
be present in the network from an earlier incarnation. We want to
assure this, even if a TCP crashes and loses all knowledge of the
sequence numbers it has been using. When new connections are created,
an initial sequence number (ISN) generator is employed which selects a
new 32 bit ISN. The generator is bound to a (possibly fictitious) 32
bit clock whose low order bit is incremented roughly every 4
microseconds. Thus, the ISN cycles approximately every 4.55 hours.
Since we assume that segments will stay in the network no more than
the Maximum Segment Lifetime (MSL) and that the MSL is less than 4.55
hours we can reasonably assume that ISN’s will be unique.

一个长度为32bit,每4微妙加一的计数器来选定ISN。然而，这个ISN的规律是可以轻易预测的，从而伪造出一个可以扰乱并注入TCP连接的TCP Segment（只要有正确的Socket和Seq Num）。因此，RFC 793这种选定ISN的做法并不可取。

而后，RFC1948中提出了一个较好的初始化序列号ISN随机生成算法：

ISN = M + F(localhost, localport, remotehost, remoteport).

其中：M是一个计时器，F是一个Hash算法。

当前，大部分操作系统都使用这种半随机的方式去选择ISN。使用“计时器 + 随机偏移量”的方法来选定ISN。