TCP Attacks: TCP Sequence Number Prediction and TCP Reset Attacks

by Himanshu Arora on January 20, 2012

Though TCP protocol is a connection oriented and reliable protocol but still there a various loopholes that can be exploited. These loop holes are mostly explained in terms of attacks.

In the previous article on the TCP/IP Attacks series, we explained about ARP Cache Poisoning.

This article explains the following two attacks:

  1.  TCP sequence prediction attack
  2.  TCP reset attacks

An overview of TCP

Before getting started with explanations of attacks. Lets develop a basic understanding of how TCP works.

A TCP header looks like the following:

The below explanation explains how a connection is established between two hosts at TCP level. This is known as three way handshake. This handshake is required before any kind of data can be sent in each direction. Once the connection is established, data can flow bi-directionally with each packet containing sequence number of beginning byte of data it contains and acknowledgment of data received.

  • Suppose there are two hosts (A and B) who want to communicate with each other. Lets suppose host A starts the communication. Now from TCP point of view, the host A sends a SYN packet to host B.
  • A SYN packet is a TCP packet with SYN flag ON.
  • Also mentioned in this packet is the Initial sequence number (which is a value generated by the TCP of host A),source port,destination port etc.
  • When this packet is received at TCP layer of host B, this host replies with a TCP packet with SYN and ACK flags ON, Initial sequence number and other information.
  • When host A receives this packet, it checks some information like the SYN flag, Acknowledgment Number (which should be Host A’s initial sequence number + 1) etc to verify that this is an expected packet from Host B.
  • In reply, host A sends a packet with ACK flag On and Acknowledgment number set to host B’s Initial sequence number + 1.

So we see that sequence numbers play an important role in TCP communication. A sequence number is a number that TCP associates with the starting byte of data in a particular packet. This way the receiving TCP keeps track of data received and acknowledges accordingly. The acknowledgment number is always the next expected sequence number.

TCP Sequence Prediction Attack

Suppose Host A and Host B are communicating with each other. Now, lets say an attacker sitting in between is somehow able to monitor the packets between A and B.

Lets see what the attacker does :

  • The attacker wants to attack Host A.
  • It floods Host B with new requests causing a Denial of service attack to stop Host B from communicating with A.
  • Now, the attacker can predict the sequence number of the packet that A is expecting from B.
  • Attacker prepares such kind of packet and sends it to Host A.
  • Since its a faked packed so host A thinks its coming from B.
  • Now, this packet can be a packet terminating the connection or asking host A to run some malicious commands/scripts etc.

So this way a connection can be hijacked by an attacker.

Another way could be the prediction of ISN(initial sequence number).

Lets see an excerpt from RFC-793 :

When new connections are created, an initial sequence number (ISN) generator is employed which selects a new 32 bit ISN. The generator is bound to a (possibly fictitious) 32 bit clock whose low order bit is incremented roughly every 4 microseconds. Thus, the ISN cycles approximately every 4.55 hours. Since we assume that segments will stay in the network no more than the Maximum Segment Lifetime (MSL) and that the MSL is less than 4.55 hours we can reasonably assume that ISN’s will be unique.

BSD TCP/IP stacks diverts away from the above mechanism. BSD TCP/IP stacks increase the sequence number by 128,000 every second and by 64,000 for every new TCP connection. This as you can imagine is more predictable and hence can be easily exploited.

TCP Reset Attacks

This attack is fairly simple to understand once the above attack is clear to you. In this attack :

  • Once the attacker is able to hijack a TCP session (as told above), this attack can be launched.
  • The attacker sends packets with RST Flag ON to both A and B or any one of the host.
  • Since both A and B do not know that an attacker has sent these packets so they treat these packets normally.
  • Since they are reset packets so connection between A and B is terminated.

So we can see that TCP reset attacks are aimed to terminate a valid TCP connection between two hosts.


Linux Sysadmin Course Linux provides several powerful administrative tools and utilities which will help you to manage your systems effectively. If you don’t know what these tools are and how to use them, you could be spending lot of time trying to perform even the basic administrative tasks. The focus of this course is to help you understand system administration tools, which will help you to become an effective Linux system administrator.
Get the Linux Sysadmin Course Now!

If you enjoyed this article, you might also like..

  1. 50 Linux Sysadmin Tutorials
  2. 50 Most Frequently Used Linux Commands (With Examples)
  3. Top 25 Best Linux Performance Monitoring and Debugging Tools
  4. Mommy, I found it! – 15 Practical Linux Find Command Examples
  5. Linux 101 Hacks 2nd Edition eBook Linux 101 Hacks Book

Bash 101 Hacks Book Sed and Awk 101 Hacks Book Nagios Core 3 Book Vim 101 Hacks Book

{ 5 comments… read them below or add one }

1 Denis January 20, 2012 at 3:38 am

excellent tutorial. thank you very much. i was wondering if you could include more tutorials on storage?

2 Reynold February 4, 2012 at 10:27 am

Thanks for the info .. it would be great if you could add some practical ways to carry out this attack and the countermeasures that can be applied to protect the system from these kind of attack..

3 mike March 19, 2012 at 2:17 pm

Please add some demos!

4 ananthan July 27, 2012 at 9:00 am

This article lacks solution :-(
will setting time-stamps prevent this attack??

5 annenarg December 11, 2012 at 8:54 am

Time-stamps would not prevent this attack, because the attacker can estimate it, too.

Leave a Comment

Previous post:

Next post: