Thanks.<br><br>I have my kernel compiled with TCP_MD5SIG.<br><br>[root@quagga2 ~]# uname -a<br>Linux quagga2 2.6.35.14-106.49.amzn1.x86_64 #1 SMP Fri Dec 2 18:19:57 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux<br>[root@quagga2 ~]# grep MD5 /boot/config-2.6.35.14-106.49.amzn1.x86_64<br>
CONFIG_TCP_MD5SIG=y<br># CONFIG_SCTP_HMAC_MD5 is not set<br>CONFIG_CRYPTO_MD5=y<br><br>however, I get the following on tcpdump output.<br><br>17:32:35.031248 IP (tos 0xc0, ttl 255, id 4621, offset 0, flags [DF], proto TCP (6), length 72)<br>
xxxxxxxxxx.37989 > xxxxxxxxxx.bgp: Flags [S], cksum 0x8cb0 (correct), seq 1652793081, win 5840, options [nop,nop,<b>md5shared secret not supplied with -M, can't check - 34c5e4259ac630f773714efcd62cf420</b>,mss 1460,nop,nop,sackOK,nop,wscale 6], length 0<br>
<br>I wonder if i can disable tcp signature verification using sysctl or something alike, without recompiling?<br><br><br><br><div class="gmail_quote">On Tue, Jan 10, 2012 at 9:02 AM, richard -rw- weinberger <span dir="ltr"><<a href="mailto:richard.weinberger@gmail.com">richard.weinberger@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Tue, Jan 10, 2012 at 5:05 AM, Nitin Sharma <<a href="mailto:nitinics@gmail.com">nitinics@gmail.com</a>> wrote:<br>
> Is there an equivalent of<br>
> (freeBSD)<br>
> sysctl net.inet.tcp.signature_verify_input=0<br>
><br>
> in linux?<br>
> 2.6.35.14-x<br>
><br>
> How is the MD5 verification of incoming TCP packets done?<br>
<br>
</div></div>See CONFIG_TCP_MD5SIG.<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Thanks,<br>
//richard<br>
</font></span></blockquote></div><br>