From the 'Counting' paper: ] A keyed generator, as is used in OpenBSD and FreeBSD, ] provides some protection, but one needs to be careful ] to avoid duplication if the generator is rekeyed ] periodically. This feature can be enabled in FreeBSD with a kernel compile option. From the /usr/src/sys/i386/conf/LINT file: ]] # RANDOM_IP_ID causes the ID field in IP packets to be randomized ]] # instead of incremented by 1 with each packet generated. This ]] # option closes a minor information leak which allows remote ]] # observers to determine the rate of packet generation on the ]] # machine by watching the counter. ]] options RANDOM_IP_ID RE: A Technique for Counting NATted Hosts [PDF] |