  The battle for a more secure Internet is waged on many fronts, including the
most basic of networking protocols. Our focus is the IPv4 Identifier (IPID), an
IPv4 header field as old as the Internet with an equally long history as an
exploited side channel for scanning network properties, inferring off-path
connections, and poisoning DNS caches. This article taxonomizes the 25-year
history of IPID-based exploits and the corresponding changes to IPID selection
methods. By mathematically analyzing these methods' correctness and security
and empirically evaluating their performance, we reveal recommendations for
best practice as well as shortcomings of current operating system
implementations, emphasizing the value of systematic evaluations in network
security.
