RFC6056(7) | Miscellaneous Information Manual | RFC6056(7) |
rfc6056
— port
randomization algorithms
The rfc6056
algorithms are used in order
to randomize the port allocation of outgoing UDP packets, in order to
provide protection from a series of “blind” attacks based on
the attacker's ability to guess the sequence of ephemeral ports associated
with outgoing packets. For more information consult RFC 6056.
The individual algorithms are described below.
The following algorithms are available:
anonportmax
and
proceeds decreasingly through the available ephemeral ports.The following sysctl controls are available for selecting the default port randomization algorithm:
sysctl name | Type | Changeable |
net.inet.ip.anonportalgo.available | string | no |
net.inet.ip.anonportalgo.selected | string | yes |
net.inet6.ip6.anonportalgo.available | string | no |
net.inet6.ip6.anonportalgo.selected | string | yes |
The IP_PORTSEL
socket option at the
IPPROTO_IP
level and the
IPV6_PORTSEL
socket option at the
IPPROTO_IPV6
level can be used with a string
argument specifying the algorithm's name in order to select the port
randomization algorithm for a specific socket. For more info see
setsockopt(2).
The rfc6056
algorithms first appeared in
NetBSD 6.0.
August 25, 2011 | NetBSD 10.99 |