3

I want to identify an UDP or TCP packet that have its source IP address faked. My guess is that even if the packet is faked with a program such has hping, the MAC src address is still the same on all the faked packets, is this correct?

If my idea is not correct, how can I identify such packets that are being faked and looks like it has different source for each and every packet?

Thanks.

Kevin Reid
  • 37,492
  • 13
  • 80
  • 108
Nergal Dimitri
  • 35
  • 5

3 Answers3

4

MAC addresses can be faked too.

With TCP, its easy to identify / handle this. You'll reply to a fake SYN packet with a SYN-ACK. If it was a real client, it'd reply with an ACK to complete the handshake. Only caveat is that you'll have to implement syn-cookies so that you don't create state & use up resources while waiting for an ACK.

With UDP, there is no way to know, since the protocol is connection-less. If you send a reply to the fake packet, you're not guaranteed a response from a "real" client. So there is no way to identify a fake one.

jman
  • 11,334
  • 5
  • 39
  • 61
2

The way I see it, UDP and TCP have nothing to do with this. You're talking about only layer 2 (MAC) and layer 3 (IP). Even at that though, you have no way of knowing, because the source MAC address should be that of the closest router to the recipient (assuming the packet did not originate in your subnet.) So you should see the same MAC address for most all inbound packets (again, internet traffic only).

Now there are profiling tools like p0f that work on signatures of packets, and you could try and do some heuristics based on that information, but nothing very concreted could be determined.

Jonathon Reinhart
  • 132,704
  • 33
  • 254
  • 328
  • Yes, its the IP layer for sure, but can you give me some heads up for how such tools profile the data to identify? Perhaps check for packet amount and view how many sources and check ratio between number of source addresses compared to packets? – Nergal Dimitri Nov 11 '11 at 22:52
1

From the packet you can get the MAC address of the nearest node. Yeah you can send ACK packet to the fake source address(IP) and then use Traceroute command to know the path of the source packet, so that you can atleast find the location of the originating. It works well in TCP and you can have acknowledgement also.

cHao
  • 84,970
  • 20
  • 145
  • 172
Imposter
  • 2,666
  • 1
  • 21
  • 31