CAPEC-325: TCP Congestion Control Flag (ECN) Probe

MITRE CAPEC attack pattern

Description

This OS fingerprinting probe checks to see if the remote host supports explicit congestion notification (ECN) messaging. ECN messaging was designed to allow routers to notify a remote host when signal congestion problems are occurring. Explicit Congestion Notification messaging is defined by RFC 3168. Different operating systems and versions may or may not implement ECN notifications, or may respond uniquely to particular ECN flag types.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-200

Prerequisites

• The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

Consequences

• Confidentiality: Read Data
• Confidentiality, Access Control, Authorization: Bypass Protection Mechanism, Hide Activities

Source

• MITRE CAPEC CAPEC-325