OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Asterisk ignoring replayed libpcap sessions

From: Blue Boar (BlueBoarthievco.com)
Date: Thu Nov 02 2006 - 13:46:45 CST

If you originally thought that a simple TCP replay, with sequence and
port numbers fixed up, would always work, consider this:

-Client connects
-Server says "Say 3"
-Client says "3"
-connection continues.

So you replay that. This time:

-Server says "Say 5"
-replayed Client says "3"
-Server disconnects.

In many cases, a replayer that doesn't understand the application
protocol will fail.

Now extend that to a TCP connection that does an encryption setup with a
challenge-response.

                                        BB