9

I heard that IP spoofing is now mostly blocked by ISPs, especially on the consumer-grade links. Is there any research on the number of networks that still allow users to spoof an IP packet with an address outside originating ISP?

  • 5
    "IP spoofing is now mostly blocked by ISPs" do you have a source on that? – schroeder Sep 22 '15 at 17:37
  • That's what I heard, but I have no data to confirm or deny this. That's why I am asking whether anybody heard of any research that brings up some actual numbers related to the question. – d33tah Sep 22 '15 at 17:43
8

Yes there is some statistical data about that: http://spoofer.cmand.org/summary.php

// Quoting the referenced Pages FAQ:

Actually, our measurements clearly show that spoofing is still prevalent among approximately 25% of the autonomous systems and netblocks we survey. More importantly, a single entry point for spoofed traffic provides attackers a means to send spoofed traffic to the entire Internet. ISPs can employ filtering [RFC2827] to ensure their outbound traffic is not spoofed. But there is currently no way to ensure that inbound traffic is legitimate as long as there exist entry points for spoofed traffic. uRPF [RFC3704] does not work, and is not used, in the core of the network where routing asymmetry renders it useless.

  • Added quote from the referenced source... – davidb Sep 23 '15 at 12:26
2

Here are some testing tools that offer up the capability to test your ISP for yourself -- https://web.archive.org/web/20110721053646/http://rmeijer.home.xs4all.nl/spoofaudit.html -- http://spoofer.csail.mit.edu/ -- each will provide some mechanism to detect if IP spoofing is possible, although you may need at least two nodes inside that specific ISP in order to test the two-way characteristics of said IP spoofing.

The Electronic Frontier Foundation (EFF) also offers a tool to test your ISP, which may detect IP-spoofing capabilities, but also much more -- https://www.eff.org/pages/switzerland-network-testing-tool -- if your ISP (or the target one you are testing out) is messing with your DNS or Javascript, but they aren't protecting the network from IP spoofing, then clearly their priorities are out of whack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.