2

I know it is trivial to spoof your IP address with UDP: simply change the value of the source address in the IP header and the recipient has no idea where the packet actually came from.

My question is whether I can put a local value in this header field (e.g. 192.168.1.1 or even 127.0.0.1) and still expect the packet to arrive over the Internet. Do routers (either from your ISP, other Internet routers, or the recipient's routers) filter it out?

Any router that routes from/to WAN should filter out any packets with local addresses, but the question is whether that actually commonly happens. For example I'd also expect ISPs to filter out source addresses that aren't in a range they own (e.g. they own 1.1.1.1/24 so then packets that seemingly originate from 1.2.1.1 should never leave the network), but nobody seems to implement that.

|improve this question
  • I think your computer will not accept the requests even if the messages reach it. – Neil Smithline Nov 28 '15 at 20:48
  • Check it rather, just look at your firewall log. – dan Nov 28 '15 at 23:39
  • It sounds like to answer this question we are required to speculate on how often routers on the Internet follow best practices. – ash Nov 29 '15 at 12:01
  • 1
    @ash More or less, but there is a big difference between, say, "basically it's never done" and "near universal in the western world". I don't know which of the two it is and it's pretty easy to distinguish between the former and the latter, even if all you have is personal accounts. That's what I'm after. And you could say the same for a thousand other questions, like "why do some websites only allow short passwords" (or something like that is one of the more popular questions on this site). I could perhaps rephrase my question to "why doesn't everyone" to make it more objective... – Luc Nov 29 '15 at 15:14
  • And there are here quite different questions to ask: ---- "Do ISP regularly implement BCP Ingress filtering?" ---- "Do companies regularly implement BCP Egress filtering?" – dan Nov 29 '15 at 22:59
2

Yes you can put an RFC1918 IP address as your IP source address. You can even use a valid IP address within the targeted network you send your packet to.

Correctly configured router of Internet connection should block such a packet coming from the outside with an IP address from the inside. This is what is called Ingress filtering.

ISP routers don't implement Ingress filtering since they don't know in advance which IP addresses are valid inside a given network target.

|improve this answer
  • I assume "@IP" is shorthand for "IP address" or something? And you only mention ingress filtering, but what about egress filtering by my ISP or other core Internet routers? That is also part of the answer to the question whether it'll arrive on the other end. – Luc Nov 28 '15 at 23:54
  • Of course, @ == "at" or "address of". – dan Nov 28 '15 at 23:56
  • Your ISP and Internet core routers can't do any Egress filtering for the same reason: they don't have an inside and an outside. Really few companies implement Egress filtering :(. – dan Nov 28 '15 at 23:58
  • Well the edge routers at my ISP certainly have an inside and outside, but more importantly, no ISP routers nor any Internet core routers should ever see any RFC1918 addresses... right? Or am I missing something? – Luc Nov 29 '15 at 0:00
  • You ISP edge router is shared by many customers. Edge or core routers of the Internet should reject any RFC 1918 source and destination @IP! – dan Nov 29 '15 at 0:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.