Vulnerability Development: Re: Asterisk ignoring replayed libpcap sessions

[Blue Boar <BlueBoar () thievco com>]

If you originally thought that a simple TCP replay, with sequence and 
port numbers fixed up, would always work, consider this:
-Client connects
-Server says "Say 3"
-Client says "3"
-connection continues.

So you replay that.  This time:

-Server says "Say 5"
-replayed Client says "3"
-Server disconnects.

In many cases, a replayer that doesn't understand the application 
protocol will fail.
Now extend that to a TCP connection that does an encryption setup with a 
challenge-response.
                                        BB