• July 27 2000: update to support 2.4.0 test4 kernels.

The Linux IP Personality patch adds to your Linux 2.4 kernel the ability to have different 'personalities' network wise, that is to change some characteristics of its network traffic, depending on different parameters (anything you can specify in an iptables rule: src/dst IP address, TCP or UDP port, etc.)

The characteristics that can be changed are:

• TCP Initial Sequence Number (ISN)
• TCP initial window size
• TCP options (their types, but also their order in the packet)
• answers to some pathological TCP packets
• answers to some UDP packets

This patch relies on the wonderful framework created by Rusty Russel: netfilter. More precisely, our patch adds a new iptables target (in a kernel module) that can be used in the mangle table with a (patched) iptables. This target is very configurable. See the developers' section for more details on the way it works.

If you ask this, then you don't. ;-)

The primary objective of this patch is to counter network fingerprinting techniques, as described in Fyodor's article.

Fyodor is the author of nmap, the famous port scanner that has a powerful remote OS detection engine. Our patch can fool current (2.53) versions of nmap, and is very configurable, so that he can probably fool any similar tool. The patch allows us to emulate the behaviour of any system listed in nmap's list of OS fingerprints. Some of the features of our patch can be applied to routed traffic, and thus disturb scans directed to machines we are routing. Some features (eg TCP ISN rewriting) can be used to improve network security.

The IP Personality patch has been developed by Gaël Roualland and Jean-Marc Saffroy, as an end of studies project at ENSERB (french engineering school in computer science), under the direction of Anne Facq (CRPP) and Laurent Facq (REAUMUR/Universite Bordeaux I).

It is placed under the GNU General Public License (GPL).