Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am convinced that it is possible to find out the real IP address of computer which has spoofed its address. I find it rather unlikely that no techniques exist against IP spoofing.

How is it possible to find out the address of spoofed IPs? What methods are used? How do you detect spoofed IPs?

share|improve this question
    
On what basis are you 'convinced'? –  schroeder Jan 13 at 17:03

3 Answers 3

An important point must be made, which is that IP spoofing is limitative. When an attacker uses a fake IP for the packets he sends, he will usually not be able to receive the answer, unless he has some extensive power over the overall network: that's because the response will be sent to the fake IP, not the attacker's actual IP address. In particular, this makes it hard for the attacker to spoof IP addresses for TCP connections.

In fact, most successful intrusions have a non-spoofed components. Attackers use relay hosts (compromised machines around the world) to try to make them harder to track down, but that's not spoofing.

Spoofing can be detected in some cases because it "looks weird". Consider an ISP; from the ISP point of view, there are two sorts of IP addresses: its addresses (i.e. the one he grants to its customers), and the rest of the World. In the ISP routers, packets with a "external" source address should be seen as incoming packets (coming from the outside), not as outgoing packets; and vice versa for packets with an "internal" source address. If one of the ISP customer sends a packet with a spoofed external address, this will show up as an outgoing packet, coming from the inside, but with an external source address; the ISP routers will find such an occurrence anomalous and may report it. The ISP can then further track down such packets down its infrastructure and thus pinpoint the culprit.

share|improve this answer
    
i dont get the part "how external source packets should be seen as incoming packet" ?? –  Computernerd Jan 12 at 17:18
1  
@Computernerd That's called "ingress" (and "ingress filtering" is the system that attempts to detect and drop spoofed packets). It basically means that if interface A is connected to a known list of subnets attached (directly or through an internally routed network), it should never receive (or forward) any packet that has a source address that isn't part of one of these subnets. –  Stephane Jan 13 at 15:13
1  
Doh! it's "egress" filtering, not "ingress" filtering. Egress is for outgoing traffic while ingress is for incoming traffic (and harder to implement) –  Stephane Jan 13 at 15:45

Your question seems to indicates you do not understand how IP works, how IP routing works and how TCP is implemented on top of it (and incidentally, what IP address spoofing really means)

Routing

IP implements a routed datagram protocol: each datagram (packet) has (among other things) a source address, a destination address and a payload (there are many other properties but they do not impact this discussion).

In the simplest case (i.e. without any type of filtering or NATing in place), each router along the way only looks at the destination address, match it against its own routing table and then forward it to the next hop on the correct interface. The return address is only looked at by the system at the end of the path (either the destination host or, if the packet has been dropped early, the system that needs to send the notification back).

Spoofing

Spoofing the source IP means replacing the source address of a packet by some other random host. It is usually (not exclusively) used in order to hide the source of this packet, to force the target into sending network traffic in direction of the spoofed host (typical of a network traffic amplification attack like DNS amplification).

Detecting a spoofed packet can, therefore, only be done close to the source of the traffic: In a simple case, the first router on the path has the possibility to detect that the source address in the packet does not belong to any of the internal networks it knows of and therefore could drop it (that is called "egress filtering"). Unfortunately, this type of check can only be done inside or at the edge of a network and it is usually only performed by firewalls and needs to be carefully setup to avoid side effects (and therefore, not widely implemented).

Another almost identical technique, ingress filtering, tries to packet coming into the network but it must rely on some knowledge of the connected network. Typically, it only works of the filtering devices knows of all the networks that are connected through it extensively (i.e. it's mostly useful between members of a peering).

TCP

TCP implements a stream connection on top of the IP protocol. As part of this implementation, it will require multiple IP packets to be sent back and forth between the client and the server in order to exchange any data (first through a 3-way handshake to establish a "connection" and then through packet acknowledgment). It means that, should the source address of an IP packet of type TCP be incorrect, the peer will not be able to send the proper response to it and the packet will be dropped.

In some special cases, it is still possible to spoof a source address in a TCP connection but that requires the source of the traffic to either be able to monitor or predict the response from the target host in order to forge the proper answer.

Your questions

In regard of the above:

How is it possible to find out the address of spoofed IPs?

Assuming you mean "the real address of the spoofed packet", you can't unless you're on the same subnet as the source. Any packet that is forwarded any further will lose more and more information about the real source of the traffic (you will only be able to know accurately which interface the traffic arrived from on and therefore potentially limit the potential networks it could have originated from, but nothing else).

What methods are used?

The only way to find the source of a spoofed packet is to monitor each hop on the path of that packet and identify where that traffic comes from. Then, you do the same with this source until you've narrowed the potential source enough. This typically requires the cooperation of each and every hop on the real path of the traffic and that is a slow (and expensive) process. It's typically not worth the effort.

How do you detect spoofed IPs?

It depends on what part of the network path you're talking about.

On the final host, it is very difficult: you more or less have to have a way to vet for each and every packet that arrives (for instance, by preventing datagram traffic coming from external networks to reach your host and only allowing TCP or similar protocols.

At or near the source of the traffic, it is much easier: you simply drop every packet that has a source address that isn't part of the networks you know are connected to a specific interface.

In between, you could filter traffic using in/egress rules (although the further from the source of the traffic you get, the less efficient that becomes).

share|improve this answer

If an attacker (or other) spoofs their IP address, as far as TCP/IP is concerned then, if performed correctly, the request looks like a genuine request from the spoofed IP and the spoofed IP will recieve the response from the server, not the attacker/sender. You will not be able to trace it unless you hold some sway over the network i.e the machines that routed the request.

I think what the answer above means by "packets with a "external" source address should be seen as incoming packets" is that any inbound requests that do not belong to the IP block(s) the the ISP owns are treated as external.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.