Spoofing Source IP - is it possible?

[Guest]

Archived from groups: microsoft.public.windowsnt.protocol.tcpip (More info?)

I was thinking about spoofed IPs and i cant work out how you could spoof
an IP.

If I was to create a IP packet I could easily change the Source IP if i
created the packet myself or used a custom pkt gen tool like Nemesis.
But as soon as the pkt gets to my ISP the IP is changed, because no
matter what the original source IP (regardless of if NAT or Proxy is
used) it appears the same from the point of view of the internet.

If you go to a site that reports you IP it is always that assigned by
your ISP.

Please enlighten me as to how spoofing works.

Cheers P.

 

[Guest]

Archived from groups: microsoft.public.windowsnt.protocol.tcpip (More info?)

In article <cjju94$cjt$1@sparta.btinternet.com>,
Peter Piper <NoEmail@Email.com> wrote:
>If I was to create a IP packet I could easily change the Source IP if i
>created the packet myself or used a custom pkt gen tool like Nemesis.
>But as soon as the pkt gets to my ISP the IP is changed,

Where did you get the idea that your ISP changes the source IP
address? Are you talking about Network Address Translation?

> because no
>matter what the original source IP (regardless of if NAT or Proxy is
>used) it appears the same from the point of view of the internet.
>
>If you go to a site that reports you IP it is always that assigned by
>your ISP.

Well of course your public IP address is going to be shown. What were
you expecting?

--
-- Rod --
rodd(at)polylogics(dot)com

 

[Guest]

Archived from groups: microsoft.public.windowsnt.protocol.tcpip (More info?)

Look at http://www.codeguru.com/network/tcpip_lib31.html
for spoofing
Arkady

"Peter Piper" <NoEmail@Email.com> wrote in message
news:cjju94$cjt$1@sparta.btinternet.com...
> I was thinking about spoofed IPs and i cant work out how you could spoof
> an IP.
>
> If I was to create a IP packet I could easily change the Source IP if i
> created the packet myself or used a custom pkt gen tool like Nemesis.
> But as soon as the pkt gets to my ISP the IP is changed, because no
> matter what the original source IP (regardless of if NAT or Proxy is
> used) it appears the same from the point of view of the internet.
>
> If you go to a site that reports you IP it is always that assigned by
> your ISP.
>
> Please enlighten me as to how spoofing works.
>
> Cheers P.

 

[Guest]

Archived from groups: microsoft.public.windowsnt.protocol.tcpip (More info?)

Im simply asking a question... trying to understand.
So if you could explain how IP spoofing works I may learn. Bluntly being
told im wrong does'nt help.

Rod Dorman wrote:
> Where did you get the idea that your ISP changes the source IP
> address? Are you talking about Network Address Translation?

I got the idea from the fact that no matter what Source IP packet starts
with eg. 192.0.0.1 or 10.0.0.1, when it gets to the internet it has an
IP assigned by your ISP. ie. yes NAT.

So the question is how do you spoof a source IP? If the IP is always
NAT'd how do you make it appear as if a packet came from a different PC.

Rod Dorman wrote:
> Well of course your public IP address is going to be shown. What were
> you expecting?

I know that, but how do you get a different IP to be shown (ie. IP
spoofing), ie. the orignal question.

Thanks P.


Rod Dorman wrote:
> In article <cjju94$cjt$1@sparta.btinternet.com>,
> Peter Piper <NoEmail@Email.com> wrote:
>
>>If I was to create a IP packet I could easily change the Source IP if i
>>created the packet myself or used a custom pkt gen tool like Nemesis.
>>But as soon as the pkt gets to my ISP the IP is changed,
>
>
> Where did you get the idea that your ISP changes the source IP
> address? Are you talking about Network Address Translation?
>
>
>>because no
>>matter what the original source IP (regardless of if NAT or Proxy is
>>used) it appears the same from the point of view of the internet.
>>
>>If you go to a site that reports you IP it is always that assigned by
>>your ISP.
>
>
> Well of course your public IP address is going to be shown. What were
> you expecting?
>

 

[Guest]

Archived from groups: microsoft.public.windowsnt.protocol.tcpip (More info?)

In article <cjr6it$8kj$1@sparta.btinternet.com>,
Peter Piper <NoEmail@Email.com> wrote:
>Im simply asking a question... trying to understand.
>So if you could explain how IP spoofing works I may learn. Bluntly being
>told im wrong does'nt help.

You stated that you knew how it could be done

> If I was to create a IP packet I could easily change the Source IP
> if i created the packet myself or used a custom pkt gen tool like
> Nemesis.

but then went off on a tangent with

> But as soon as the pkt gets to my ISP the IP is changed, because no
> matter what the original source IP (regardless of if NAT or Proxy is
> used) it appears the same from the point of view of the internet.

Simply put IP spoofing is putting someone elses IP address in a packet
you are sending.

There's tons of references/descriptions out on the web, try Googleing
for them.

--
-- Rod --
rodd(at)polylogics(dot)com

 

[Guest]

Archived from groups: microsoft.public.windowsnt.protocol.tcpip (More info?)

Thanks for the 'help'.
If i wanted to search the web i would have done. Instead i choose to use
newsgroups.
I know ip spoofing can be done, but not how. I bit like knowing a jet
can fly but not how the engine works.
The tangent was how i thought ip spoofing would work, but would'nt.
Thanks Rod.

Rod Dorman wrote:
> In article <cjr6it$8kj$1@sparta.btinternet.com>,
> Peter Piper <NoEmail@Email.com> wrote:
>
>>Im simply asking a question... trying to understand.
>>So if you could explain how IP spoofing works I may learn. Bluntly being
>>told im wrong does'nt help.
>
>
> You stated that you knew how it could be done
>
>
>>If I was to create a IP packet I could easily change the Source IP
>>if i created the packet myself or used a custom pkt gen tool like
>>Nemesis.
>
>
> but then went off on a tangent with
>
>
>>But as soon as the pkt gets to my ISP the IP is changed, because no
>>matter what the original source IP (regardless of if NAT or Proxy is
>>used) it appears the same from the point of view of the internet.
>
>
> Simply put IP spoofing is putting someone elses IP address in a packet
> you are sending.
>
> There's tons of references/descriptions out on the web, try Googleing
> for them.
>