Beefy Boxes and Bandwidth Generously Provided by pair Networks
more useful options

Re: Re: Re: is IP# in $ENV{REMOTE_ADDR} spoofable?

by mdillon (Priest)
on Oct 14, 2002 at 01:23 UTC ( #204954=note: print w/replies, xml ) Need Help??

in reply to Re: Re: is IP# in $ENV{REMOTE_ADDR} spoofable?
in thread is IP# in $ENV{REMOTE_ADDR} spoofable?

Update: I just re-read what jepri said and realized that I was wrong in my initial response. He is correct that a spoofed IP address will prevent a TCP connection from being established, since the origin application will need to use the TCP sequence number from the destination server's SYN-ACK packet to completely establish the connection. The stuff I said only applies to connectionless IP protocols, not those with connections like TCP. Sorry. I have removed the original contents of this node to avoid misleading anyone.

A TCP connection can only be spoofed if the TCP sequnce number returned by the server can be predicted. If it can, then an attacker with the ability to spoof IP addresses can just send all the packets for the HTTP request without requiring the acknowledging packets from the server. This is referred to as "Blind TCP Spoofing". This article provides a decent overview.

  • Comment on Re: Re: Re: is IP# in $ENV{REMOTE_ADDR} spoofable?

Replies are listed 'Best First'.
Re: Re: Re: Re: is IP# in $ENV{REMOTE_ADDR} spoofable?
by jepri (Parson) on Oct 14, 2002 at 01:44 UTC
    I'm afraid that this is incorrect. You can't change horses midstream in a TCP connection. I've tried it and the connection locks up. The trick is that in order to open the connection, both parties must reveal their true IP, or the connection won't open. The TCP connection build-up works like this:

    • The initiator of the session sends a segment with the SYN flag set to the recipient.
    • Upon receipt of the segment, the recipient sends a SYN segment to the initiator with the ACK number set to the sequence number + 1, and sets new sequence number for its own end.
    • The initiator then sends an ACK of its own in response to the recipient's SYN, with the ACK number set to the recipeint's sequence number + 1.

    After these steps are completed, no data has been transferred, the connection is open, and both parties know the correct address of the other party. If one party fakes the address the connection will jam. This is the now-famous 'syn attack'.

    This is how you are able to find out the remote IP address when you do a $socket->accept call to receive an incoming connection.

    As I mentioned earlier (because I knew it would get brought up), it is possible to spoof ICMP packets, because ICMP does not build a connection like TCP does.

    Also, earlier versions of windows can do raw sockets (otherwise they couldn't do any networking at all), but their native libraries don't have a API for raw sockets. There are libraries for these systems to provide raw sockets though.

    I didn't believe in evil until I dated it.

Log In?

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://204954]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others avoiding work at the Monastery: (6)
As of 2022-12-10 09:15 GMT
Find Nodes?
    Voting Booth?

    No recent polls found