Bouncing ISNs


Create Raw IP packets:
Set destination to 'bounce' host.
Set source to actual destination host.
Data is encoded in the ISN.

Bounce host will see the SYN:
Sends a SYN | ACK to forged source.
SYN | ACK includes ISN+1.

Actual destination server:
Kernel sends RST.

Sniffer sees packet.
Decrements ISN.
Processes covert data.