RE: IP Spoofing/Masquarading

["Erik Soosalu" <eriks () nationalfastfreight com>]

Routers by default are programmed to forward *all* traffic.  They tend to only look at the destination addresses only 
and forward the packet to the interface with a matching route.

You then use an access control list to block private network traffic, which is of course meaningless if the user spoofs 
with a publically routable address.  But then again, that is what Unicast Reverse Path Forwading helps deal with.

Thanks,
Erik


-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Gerardo Castillo Alvarado
Sent: Wednesday, September 09, 2009 10:10 AM
Cc: pen-test () securityfocus com; security-basics
Subject: Re: IP Spoofing/Masquarading

M.D.Mufambisi escribió:
> However, when this is done across the internet, with a private IP
> address in its source field, how does this packet get routed through
> the internet?
>   
Supposedly, routers are not programmed to forward traffic with these
address ranges (FRC1918) outside of local organizations; nevertheless,
all border routers should drop all incoming packet somewhat quirky...

On the other hand, there are preceding to intercept internet traffic
though with other techniques [1].

[1] http://www.wired.com/threatlevel/2008/08/revealed-the-in/

best regards!

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------



------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------