IETF RFC 6274

[ACTIVE]

Security Assessment of the Internet Protocol Version 4

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 75
Abstract: This document contains a security assessment of the IETF specifications of the Internet Protocol version 4 and of a number of mechanisms and policies in use by popular IPv4 implementations. It is based on the results of a project carried out by the UK's Centre for the Protection of National Infrastructure (CPNI). This document is not an Internet Standards Track specification; it is published for informational purposes.
Publication Date: 2011-07-01
Status Note: Informational
DOI: 10.17487/RFC6274
Link: https://doi.org/10.17487/RFC6274
Author(s): Fernando Gont
Keyword(s): Vulnerabilities, DoS, Resilience, Information Leakage

Latest version of IETF RFC 6274

Document Versions — IETF RFC 6274

▶ IETF RFC 6274 (2011-07-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 791 [Active*]
IETF RFC 826 [Active*]
IETF RFC 1038 [Superseded*]
IETF RFC 1063 [Superseded*]
IETF RFC 1108 [Active*]
IETF RFC 1112 [Active*]
IETF RFC 1122 [Active*]
IETF RFC 1191 [Active*]
IETF RFC 1349 [Superseded*]
IETF RFC 1393 [Superseded*]
IETF RFC 1770 [Superseded*]
IETF RFC 1812 [Active*]
IETF RFC 1918 [Active*]
IETF RFC 2113 [Active*]
IETF RFC 2119 [Active*]
IETF RFC 2474 [Active*]
IETF RFC 2475 [Active*]
IETF RFC 2644 [Active*]
IETF RFC 2827 [Active*]
IETF RFC 3168 [Active*]
IETF RFC 3704 [Active*]
IETF RFC 3927 [Active*]
IETF RFC 4086 [Active*]
IETF RFC 4632 [Active*]
IETF RFC 4821 [Active*]
IETF RFC 5082 [Active*]
IETF RFC 5350 [Active*]
IETF RFC 5735 [Superseded*]
IETF RFC 6040 [Active*]

Bibliographic Reference(s)

NIST.FIPS.188 — FP188 EXTERNAL
Biondi, P. and A. Ebalard, "IPv6 Routing Header Security", CanSecWest 2007 Security Conference, 2007, < http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf >. EXTERNAL
CIPSO, "COMMERCIAL IP SECURITY OPTION (CIPSO 2.2)" , Work in Progress, 1992. EXTERNAL
Shannon, C., Moore, D., and K. Claffy, "Characteristics of Fragmented IP Traffic on Internet Links", 2001. EXTERNAL
Kenney, M., "The Ping of Death Page", 1996, < http://www.insecure.org/sploits/ping-o-death.html >. EXTERNAL
Bendi, "Bonk exploit", 1998, < http://www.insecure.org/sploits/ 95.NT.fragmentation.bonk.html >. EXTERNAL
Microsoft, "Microsoft Security Program: Microsoft Security Bulletin (MS99-038). Patch Available for "Spoofed Route Pointer" Vulnerability", 1999, < http://www.microsoft.com/ technet/security/bulletin/ms99-038.mspx >. EXTERNAL
Sanfilippo, S., "about the ip header id", Post to Bugtraq mailing-list, Mon Dec 14 1998, < http://www.kyuzz.org/antirez/papers/ipid.html >. EXTERNAL
Sourcefire, Inc., "Snort", < http://www.snort.org >. EXTERNAL
Humble, "Nestea exploit", 1998, < http://www.insecure.org/sploits/ linux.PalmOS.nestea.html >. EXTERNAL
Linux Kernel Organization, "The Linux Kernel Archives", < http://www.kernel.org >. EXTERNAL
Barisani, A., "FTester - Firewall and IDS testing tool", 2001, < http://dev.inversepath.com/trac/ftester >. EXTERNAL
Ed3f, "Firewall spotting and networks analysis with a broken CRC", Phrack Magazine, Volume 0x0b, Issue 0x3c, Phile #0x0c of 0x10, 2002, < http://www.phrack.org/ issues.html?issue=60&id=12&mode=txt >. EXTERNAL
daemon9, route, and infinity, "IP-spoofing Demystified (Trust-Relationship Exploitation)", Phrack Magazine, Volume Seven, Issue Forty-Eight, File 14 of 18, 1988, <htt p://www.phrack.org/issues.html?issue=48&id=14&mode=txt>. EXTERNAL
NSA, "Security-Enhanced Linux", < http://www.nsa.gov/research/selinux/ >. EXTERNAL
Anderson, J., "An Analysis of Fragmentation Attacks", 2001, < http://www.ouah.org/fragma.html >. EXTERNAL
Jones, R., "A Method Of Selecting Values For the Parameters Controlling IP Fragment Reassembly", 2002, < ftp://ftp.cup.hp.com/dist/networking/briefs/ ip_reass_tuning.txt >. EXTERNAL
IANA, "Ether Types", < http://www.iana.org/assignments/ethernet-numbers >. EXTERNAL
Klein, A., "OpenBSD DNS Cache Poisoning and Multiple O/S Predictable IP ID Vulnerability", 2007, < http://www.trusteer.com/files/ OpenBSD_DNS_Cache_Poisoning_and_Multiple_OS_Predictable_IP _ID_Vulnerability.pdf >. EXTERNAL
Cisco, "Cisco Security Advisory: Cisco IOS Interface Blocked by IPv4 packet", 2003, < http://www.cisco.com/en/ US/products/ products_security_advisory09186a00801a34c2.shtml >. EXTERNAL
CERT, "CERT Advisory CA-1998-01: Smurf IP Denial-of- Service Attacks", 1998, < http://www.cert.org/advisories/CA-1998-01.html >. EXTERNAL
Silbersack, M., "Improving TCP/IP security through randomization without sacrificing interoperability", EuroBSDCon 2005 Conference, 2005, < http://www.silby.com/eurobsdcon05/eurobsdcon_slides.pdf >. EXTERNAL
Shankar, U. and V. Paxson, "Active Mapping: Resisting NIDS Evasion Without Altering Traffic", 2003, < http://www.icir.org/vern/papers/activemap-oak03.pdf >. EXTERNAL
Arkin, "IP TTL Field Value with ICMP (Oops - Identifying Windows 2000 again and more)", 2000, < http://ofirarkin.files.wordpress.com/2008/11/ ofirarkin2000-06.pdf >. EXTERNAL
Clark, D., "The Design Philosophy of the DARPA Internet Protocols", Computer Communication Review Vol. 18, No. 4, 1988. EXTERNAL
IANA, "IP Parameters", < http://www.iana.org/assignments/ip-parameters >. EXTERNAL
Cisco, "Cisco IOS Security Configuration Guide, Release 12.2", 2003, < http://www.cisco.com/en/US/docs/ios/12_2/ security/configuration/guide/scfipso.html >. EXTERNAL
Fyodor, "Idle scanning and related IP ID games", 2004, < http://www.insecure.org/nmap/idlescan.html >. EXTERNAL
Kohno, T., Broido, A., and kc. Claffy, "Remote Physical Device Fingerprinting", IEEE Transactions on Dependable and Secure Computing Vol. 2, No. 2, 2005. EXTERNAL
Cerf, V. and R. Kahn, "A Protocol for Packet Network Intercommunication", IEEE Transactions on Communications Vol. 22, No. 5, May 1974, pp. 637-648, 1974. EXTERNAL
CIPSOWG, "Commercial Internet Protocol Security Option (CIPSO) Working Group", 1994, < http://www.ietf.org/ proceedings/94jul/charters/cipso-charter.html >. EXTERNAL
MIT ANA, "Spoofer Project", 2010, < http://spoofer.csail.mit.edu/index.php >. EXTERNAL
Ptacek, T. and T. Newsham, "Insertion, Evasion and Denial of Service: Eluding Network Intrusion Detection", 1998, < http://www.aciri.org/vern/Ptacek-Newsham-Evasion-98.ps >. EXTERNAL
Zakrzewski, M. and I. Haddad, "Linux Distributed Security Module", 2002, < http://www.linuxjournal.com/article/6215 >. EXTERNAL
Sanfilippo, S., "PF: Scrub (Packet Normalization)", 2010, < ftp://ftp.openbsd.org/pub/OpenBSD/doc/pf-faq.pdf >. EXTERNAL
IANA, "Protocol Numbers", < http://www.iana.org/assignments/protocol-numbers >. EXTERNAL
Bellovin, S., "A Technique for Counting NATted Hosts", IMW'02 Nov. 6-8, 2002, Marseille, France, 2002. EXTERNAL
US-CERT, "US-CERT Vulnerability Note VU#310387: Cisco IOS discloses fragments of previous packets when Express Forwarding is enabled", 2002. EXTERNAL
CERT, "CERT Advisory CA-1999-17: Denial-of-Service Tools", 1999, < http://www.cert.org/advisories/CA-1999-17.html >. EXTERNAL
Le Faucheur, F., Ed., "IP Router Alert Considerations and Usage", Work in Progress, June 2011. EXTERNAL
Bellovin, S., "Security Problems in the TCP/IP Protocol Suite", Computer Communication Review Vol. 19, No. 2, pp. 32-48, 1989. EXTERNAL
CERT, "CERT Advisory CA-1996-26: Denial-of-Service Attack via ping", 1996, < http://www.cert.org/advisories/CA-1996-26.html >. EXTERNAL
Song, D., "Frag router tool", < http://www.monkey.org/~dugsong/fragroute/ >. EXTERNAL
Paxson, V., Handley, M., and C. Kreibich, "Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics", USENIX Conference, 2001. EXTERNAL
Watson, P., "Slipping in the Window: TCP Reset Attacks", CanSecWest Conference, 2004. EXTERNAL
NISCC, "NISCC Vulnerability Advisory 236929: Vulnerability Issues in TCP", 2004, < http://www.cpni.gov.uk >. EXTERNAL
Northcut, S. and Novak, "Network Intrusion Detection - An Analyst's Handbook", Second Edition New Riders Publishing, 2000. EXTERNAL
CERT, "CERT Advisory CA-1998-13: Vulnerability in Certain TCP/IP Implementations", 1998, < http://www.cert.org/advisories/CA-1998-13.html >. EXTERNAL
Novak, "Target-Based Fragmentation Reassembly", 2005, < http://www.snort.org/assets/165/target_based_frag.pdf >. EXTERNAL
LBNL/NRG, "arpwatch tool", 2006, < http://ee.lbl.gov/ >. EXTERNAL
OpenBSD, "OpenBSD Security Advisory: IP Source Routing Problem", 1998, < http://www.openbsd.org/advisories/sourceroute.txt >. EXTERNAL
Haddad, I. and M. Zakrzewski, "Security Distribution for Linux Clusters", Linux Journal, 2004, < http://www.linuxjournal.com/article/6943 >. EXTERNAL
CERT, "CERT Advisory CA-1996-21: TCP SYN Flooding and IP Spoofing Attacks", 1996, < http://www.cert.org/advisories/CA-1996-21.html >. EXTERNAL
Kent, C. and J. Mogul, "Fragmentation considered harmful", Proc. SIGCOMM '87 Vol. 17, No. 5, October 1987, 1987. EXTERNAL
CERT, "CERT Advisory CA-1997-28: IP Denial-of-Service Attacks", 1997, < http://www.cert.org/advisories/CA-1997-28.html >. EXTERNAL
GIAC, "Egress Filtering v 0.2", 2000, < http://www.sans.org/y2k/egress.htm >. EXTERNAL
IRIX, "IRIX 6.5 trusted_networking(7) manual page", 2008, < http://techpubs.sgi.com/library/tpl/cgi-bin/ getdoc.cgi?coll=0650&db=man&fname=/usr/share/catman/a_man/ cat7/trusted_networking.z>. EXTERNAL
NISCC, "NISCC Vulnerability Advisory 532967/NISCC/ICMP: Vulnerability Issues in ICMP packets with TCP payloads", 2005, < http://www.gont.com.ar/advisories/index.html >. EXTERNAL
CERT, "CERT Advisory CA-1996-01: UDP Port Denial-of- Service Attack", 1996, < http://www.cert.org/advisories/CA-1996-01.html >. EXTERNAL
CERT, "CERT Advisory CA-2003-15: Cisco IOS Interface Blocked by IPv4 Packet", 2003, < http://www.cert.org/advisories/CA-2003-15.html >. EXTERNAL
Sanfilippo, S., "more ip id", Post to Bugtraq mailing- list, 1999, < http://www.kyuzz.org/antirez/papers/moreipid.html >. EXTERNAL
US-CERT, "US-CERT Vulnerability Note VU#446689: Check Point FireWall-1 allows fragmented packets through firewall if Fast Mode is enabled", 2001, < http://www.kb.cert.org/vuls/id/446689 >. EXTERNAL
Gont, F., "Security Assessment of the Internet Protocol", 2008, < http://www.cpni.gov.uk/Docs/InternetProtocol.pdf >. EXTERNAL
NISCC, "NISCC Technical Note 01/2006: Egress and Ingress Filtering", 2006, < http://www.cpni.gov.uk >. EXTERNAL
Oracle, "ORACLE SOLARIS WITH TRUSTED EXTENSIONS", 2007, <h ttp://www.oracle.com/us/products/servers-storage/solaris/ solaris-trusted-ext-ds-075583.pdf>. EXTERNAL
Sanfilippo, S., "Idle scan", Post to Bugtraq mailing-list, 1998, < http://www.kyuzz.org/antirez/papers/dumbscan.html >. EXTERNAL
Gont, F., "Advanced ICMP packet filtering", 2006, < http://www.gont.com.ar/papers/icmp-filtering.html >. EXTERNAL
IETF RFC 815 [Active*]
IETF RFC 1858 [Active*]
IETF RFC 2544 [Active*]
IETF RFC 3128 [Active*]
IETF RFC 3530 [Superseded*]
IETF RFC 4963 [Active*]
IETF RFC 4987 [Active*]
IETF RFC 5559 [Active*]
IETF RFC 5570 [Active*]
IETF RFC 5670 [Active*]
IETF RFC 5696 [Superseded*]
IETF RFC 5927 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC6274.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 6274, Security Assessment of the Internet Protocol Version 4. Available at https://doi.org/10.17487/RFC6274

Snippet:

IETF RFC 6274, Security Assessment of the Internet Protocol Version 4. Available at https://doi.org/10.17487/RFC6274

HTML (ISO 690 compliant)

Preview:

IETF RFC 6274, Security Assessment of the Internet Protocol Version 4. Available at https://doi.org/10.17487/RFC6274

Snippet:

<span class="citation"><cite>IETF RFC 6274</cite>, Security Assessment of the Internet Protocol Version 4. Available at <a href="https://doi.org/10.17487/RFC6274" target="_blank" rel="noopener">https://doi.org/10.17487/RFC6274</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 6274, Security Assessment of the Internet Protocol Version 4
doi: 10.17487/RFC6274
url: https://doi.org/10.17487/RFC6274

Snippet:

<li>
<cite id="bib-rfc6274">IETF RFC 6274</cite>, Security Assessment of the Internet Protocol Version 4
<span class="doi">10.17487/RFC6274</span>
</li>

Referenced By

IETF RFC 6946 [Active*]
IETF RFC 7657 [Active*]
IETF RFC 9416 [Active*]