david 85c8ece184 Document some limitations of decoys in the source and in the reference ...

guide. They don't honor scan delay and may violate congestion control.

Both this things should be fixed. I was going to do it by having
get_next_target_probe just return the same probe multiple times, and
then either extend struct probespec to include a source address or have
sendIPScanProbe keep track of the decoy index and fill in source
addresses. But I was stopped by timing pings. Those should certainly be
decoyed, but in the code they are just sent as they are needed, and
don't have a dispatching function to modify. What would be good is a
global queue of probes waiting to be sent you could just insert all your
spoofed probes into, and then let the rest of the code take care of
scheduling them.

2008-05-02 20:38:27 +00:00

194 KiB

Raw Blame History

View Raw