The initial TCP connection is established when the serial number (ISN) is randomly selected, then the serial number why not use a fixed value of it? There are two reasons
- Different instances of the same to prevent the (different instantiations / incarnations of the same connection) connected to a packet confusion.
Different instances of the same connection is how it happened? Before we said (source IP, source port number, destination address, destination port number) This four-tuple uniquely identifies a TCP connection, when a TCP connection when subjected to four waved closed, if there is a particularly large packet delay, and this is connected immediately with the same quad established after closing, so when a TCP packet previously this connection arrives, if the serial number also falls within the reception window, then the packet may be received in error. ISN should therefore be noted RFC0793 4μs each increment 1, thereby preventing data packets of different instances of the same connection confusion. In addition to a relatively high data integrity check should be added simultaneously at the application layer. - Serial No. prevent TCP spoofing
Let A server, B is the client with special privileges, C attacker, posing a first message B C A request to the server to establish a connection, then the IP address of the packet will be sent by C fill into a B; a second message is assumed that there is no other means to verify B, but only C is determined according to the IP address request sent over the connection establishment is sent over the B, thus transmitting the SYN + ACK B, at this time is assumed B C was performed in a DOS attack or other abnormal state can not respond to the second message (if B is in a normal state will restart in response to a TCP RST packet connection, we explain the RST packet later); the third message if properly C guess the a ISN in the second message, you can pretend to B and a complete three-way handshake process, so that a and B mistakenly think the connection is established. Then C, is counted some dangerous B transmits data or instructions to be achieved A attack.