There's more than one way to do things | |
PerlMonks |
Re: Re: Re: Re: is IP# in $ENV{REMOTE_ADDR} spoofable?by jepri (Parson) |
on Oct 14, 2002 at 01:44 UTC ( [id://204956]=note: print w/replies, xml ) | Need Help?? |
I'm afraid that this is incorrect. You can't change horses midstream in a TCP connection. I've tried it and the connection locks up. The trick is that in order to open the connection, both parties must reveal their true IP, or the connection won't open. The TCP connection build-up works like this:
After these steps are completed, no data has been transferred, the connection is open, and both parties know the correct address of the other party. If one party fakes the address the connection will jam. This is the now-famous 'syn attack'. This is how you are able to find out the remote IP address when you do a $socket->accept call to receive an incoming connection. As I mentioned earlier (because I knew it would get brought up), it is possible to spoof ICMP packets, because ICMP does not build a connection like TCP does. Also, earlier versions of windows can do raw sockets (otherwise they couldn't do any networking at all), but their native libraries don't have a API for raw sockets. There are libraries for these systems to provide raw sockets though.
____________________
In Section
Seekers of Perl Wisdom
|
|