SC_TBITBLIND(1)

💅 sc_tbitblind — section 1, General Commands Manual 💅

okay bestie, gather round — this is the manual page for sc_tbitblind, a scamper driver. She's a little niche but she is so* iconic*, fr fr.

---

✨ NAME ✨

sc_tbitblind — it's the scamper driver that tests systems to see how resilient they are to blind TCP attacks. 💀

---

🌸 SYNOPSIS 🌸

sc_tbitblind [-r] [-a addressfile] [-A application] [-c completed-file]
             [-l limit-per-file] [-o output-file] [-O options]
             [-p scamper-port] [-t log-file] [-T ttl] [-w wait-between]

---

🦋 DESCRIPTION 🦋

So sc_tbitblind is the utility that connects to a running scamper(1) instance and uses that instance to test systems for resilience to blind TCP attacks — and the output gets written to a file in warts format. Periodt.

Here's the vibe: the utility tests a given system for regular TCP behavior, and then it tests how that system responds to reset, SYN, and data packets that could have come from a blind attacker — because the sequence number isn't the next sequence number value the receiver expects (that's the reset and SYN cases), or because the acknowledgment value covers data ahead of or behind the receiver's point in their sequence number space (those are the data cases). Not me explaining sequence number space violations like it's gossip. 😭

The utility also tests the system's response to a connection that advertises support for window scaling, TCP timestamps, and Selective Acknowledgments (SACK). Very demure, very mindful, very packet-level. ✨

The options are as follows:

---

💖 OPTIONS 💖

• -? — prints a list of command line options and a synopsis of each. She's helpful like that. 🫶
• -a addressfile — specifies the name of the input file, which consists of a sequence of systems to test, one system per line. No grouping, bestie, one per line.
• -A application — specifies the type of application to simulate while testing the system. The options are HTTP and BGP.
• -c completed-file — specifies the name of a file to record IP addresses that have been tested. Receipts, basically. 🧾
• -l limit-per-file — specifies the number of tbit objects to record per warts file, before opening a new file and placing new objects. She just keeps opening new files, main character energy. 📂
• -o output-file — specifies the name of the file to be written. The output file will use the warts format.
• -O options — allows the behavior of sc_tbitblind to be further tailored. The current choices for this option are:
  • noshuffle: do not shuffle the order of the input list or the order of the tests. (lowkey the "leave it exactly as I gave it to you" button)
• -p scamper-port — specifies the port on the local host where scamper(1) is accepting control socket connections.
• -r — causes the random number generator used to shuffle tests to be seeded. 🎲
• -t log-file — specifies the name of a file to log progress output from sc_tbitblind generated at run time.
• -T ttl — specifies the IP-TTL to use with the blind TCP tests.
• -w wait-between — specifies the length of time to wait between any two TCP tests to one system. Patience is a virtue etc etc. ⏳

---

🔥 EXAMPLES 🔥

Use of this driver requires a scamper instance listening on a port for commands, which has been configured to use the IPFW firewall rules 1 to 100, as follows:

scamper -P 31337 -F ipfw:1-100

To test a set of web servers specified in a file named webservers.txt and formatted as follows:

1,example.com 1263 192.0.2.1 http://www.example.com/
1,example.com 1263 2001:DB8::1 http://www.example.com/
1,example.com 1263 2001:DB8::2 https://www.example.com/

the following command will test all servers for resilience to blind TCP attacks and record raw data into webservers_00.warts, webservers_01.warts, etc:

sc_tbitblind -a webservers.txt -p 31337 -o webservers

The webservers.txt file is required to be formatted as above. The format is: numeric ID to pass to tbit, a label for the webserver, the size of the object to be fetched, the IP address to contact, and the URL to use. Don't freestyle it, bestie. 🙈

To test a set of BGP routers specified in bgprouters.txt and formatted as follows:

192.0.2.2 65000
192.0.2.2 65001

the following command will test all BGP routers for resilience to blind TCP attacks, without shuffling the test order, waiting 180 seconds between tests, and record raw data into bgprouters_00.warts, bgprouters_01.warts, etc:

sc_tbitblind -a bgprouters.txt -p 31337 -o bgprouters -A bgp -O
noshuffle -w 180

The bgprouters.txt file is required to be formatted as above. The format of that file is: IP address to establish a BGP session with, and the ASN to use.

---

🌈 SEE ALSO 🌈

• M. Luckie, R. Beverly, T. Wu, M. Allman, and k. claffy, Resilience of Deployed TCP to Blind Attacks, Proc. ACM/SIGCOMM Internet Measurement Conference 2015. 📚
• scamper(1)
• sc_wartsdump(1)
• sc_warts2json(1)
• warts(5)

---

👑 AUTHORS 👑

sc_tbitblind was written by Matthew Luckie <mjl@luckie.org.nz>. Tiange Wu contributed an initial implementation of the blind in-window TBIT test to scamper, and Robert Beverly contributed support for testing BGP routers. Collab of the century honestly. 💜

---

okay that's the whole page, you ate that 🍓 this one shipped with the Debian build, dated September 19, 2015, and it's SC_TBITBLIND(1) — go forth and test some TCP stacks, bestie 🎀✨🦋