ip_Header 的Identification 字段中使用的增量值是多少？
我打开了 telnet 会话和wireshark ..并观察了连接。
我所知道的是 ip ident 字段的正常增量是“1”（在没有碎片的情况下），但是如果发生碎片，则标识字段将在所有碎片上保持相同
但正如我所见..它不是 1 ..它是随机变化的值
那么递增 ident 字段的算法是什么？
另一个问题：如果设置了 DF 标志..我们会查看 ident 字段还是忽略它？
I opened a telnet session and wireshark ..and observed the connection.
what I know is that the normal increment of ip ident field is "1" (in case of no fragmentation) but if fragmentation happened the identification field will remain the same over all fragments
But as I saw ..it is not 1 ..it is randomly changing value
So what is the algorithm in incrementing the ident field ?
Another question : if the DF flag was set ..do we look at the ident field or we just ignore it ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这非常依赖于实现——事实上，这些差异被用来进行操作系统指纹识别。例如，某些 Windows 系统会递增 ID，但会按主机字节顺序而不是网络字节顺序发送字段。
这并不重要，也不会引起问题，因为 ID 仅用于碎片。因此，正如您所建议的，如果设置了 DF，您可能可以忽略 ID，尽管我会合理检查碎片偏移量是否为 0 并且总长度与接收到的数据量匹配。
This is very implementation-dependent--in fact the differences are exploited to do OS fingerprinting. For example, some Windows systems increment ID, but send the field in host-byte order rather than network-byte order.
It doesn't really matter and doesn't cause problems since ID is only used for fragmentation. So as you suggest, if DF is set, you can probably ignore ID, though I would sanity check that frag offset is 0 and total length matches the amount of data received.
我的猜测是它是伪随机的，以便攻击者更难猜测序列并欺骗数据包。哪个操作系统正在生成时髦的标识值？
My guess would be that it's pseudorandom, in order to make it harder for an attacker to guess the sequence and spoof the packets. What operating system is generating the funky identification values?
我发现增量值取决于数据包之间的时间..在telnet中：如果您频繁发送快速字符..id将增加1..如果您以慢速发送字符..您会注意到差异..我没有找出真正的关系...但它与时间有关..
i found that the increment value depend on time between packets ..in telnet : if u sent frequent fast chars ..id will be incremented by one ..if u sent chars in slow speed ..u will notice the difference ..i didnt figure out the real relation ...but it is related to time ..