| RFC6056(7) | Miscellaneous Information Manual | RFC6056(7) |
rfc6056 — port
randomization algorithms
The rfc6056 algorithms are used in order
to randomize the port allocation of outgoing UDP packets, in order to
provide protection from a series of “blind” attacks based on
the attacker's ability to guess the sequence of ephemeral ports associated
with outgoing packets. For more information consult RFC 6056.
The individual algorithms are described below.
The following algorithms are available:
anonportmax and
proceeds decreasingly through the available ephemeral ports.The following sysctl controls are available for selecting the default port randomization algorithm:
| sysctl name | Type | Changeable |
| net.inet.ip.anonportalgo.available | string | no |
| net.inet.ip.anonportalgo.selected | string | yes |
| net.inet6.ip6.anonportalgo.available | string | no |
| net.inet6.ip6.anonportalgo.selected | string | yes |
The IP_PORTSEL socket option at the
IPPROTO_IP level and the
IPV6_PORTSEL socket option at the
IPPROTO_IPV6 level can be used with a string
argument specifying the algorithm's name in order to select the port
randomization algorithm for a specific socket. For more info see
setsockopt(2).
The rfc6056 algorithms first appeared in
NetBSD 6.0.
| August 25, 2011 | NetBSD 11.0 |