Given a Solaris machine with two network interfaces corresponding to the separate ethernet ports in the back.
/etc/defaultrouter set to
If a connection (either TCP or UDP) comes in on port 0, but it is from
192.168.1.6 (obviously spoofed), does that mean that any responses (the
SYN-ACK packet in the case of a TCP server, or the DNS response in case of a DNS server) will be sent out on port 1 (due to the IP address).
Or will they be dropped, or worse, will they be sent back out on port 0?
I am attempting to asses the risk of IP spoofing across physical interfaces. If a server listens on all interfaces, but only authorizes connections from
192.168.1.*, I want to know how likely it is that it will accept connections from the wrong port.
Hypothetical threat environment: port 1 is connected to trusted, non-internet network. Port 0's subnet might have a compromised machine on it.