4

DDoS attacks via spoofed DNS(sec) are daily news for the last few years, but packet filtering should prevent IP spoofing on the internet.

I tried (as an exercise) to spoof a packet on my VPS and on my local ISP (With NAT disabled) but both were filtering out these packets (Wireshark did not show the packet on either opposite sides, any other ways to test this? like a online service?).

Anyway, I was wondering if there are any statistics/information about the usage of packet filtering usage? Why are there still so many attacks meanwhile I get the impression that most direct connections to the WWW are filtering out these packets?

|improve this question
  • 2
    I don't have any numbers but this is one of those cases where it only takes a small proportion of networks to be badly run to cause problems. – Peter Green Dec 17 '15 at 14:13
  • 1
    bcp38.info/index.php/Main_Page would likely be a good place to get info about this kind of thing.. – Rory McCune Dec 17 '15 at 14:15
  • UDP doesn't specify the return IP address at the packet level, and thus there is no way to guarantee the source IP of a packet. Your ISP has to simply let these packets through. If you send UDP packets from behind a router (hardware firewall), it will open a port and will blindly route incoming UDP traffic through that open port back to the device. You can learn more about the differences by researching "TCP vs UDP hole punching". – Jonathan Gray Dec 17 '15 at 19:21
  • Why do you think your ISP performed filtering? Are DDoS attacks done using spoofed addresses? Can you provide any sources for these statements? It will be difficult to respond with statistics when it's possible the situation doesn't exist. – schroeder♦ Dec 18 '15 at 2:58
3

The reason that you were not able to spoof your source IP address is probably because your ISP uses uRPF (Unicast Reverse Path Forwarding) or some other type of IP validation filtering before routing your traffic.

uRPF Info: http://www.cisco.com/web/about/security/intelligence/unicast-rpf.html

Quote block from the uRPF page on Cisco: "Network administrators can use Unicast Reverse Path Forwarding (Unicast RPF) to help limit the malicious traffic on an enterprise network. This security feature works by enabling a router to verify the reachability of the source address in packets being forwarded. This capability can limit the appearance of spoofed addresses on a network. If the source IP address is not valid, the packet is discarded."

Since you're not using a sketchy ISP that does not provide these services, you're not able to spoof your IP address successfully. At this time, IP address spoofing can be exploited on around 25% of ISP's worldwide (http://spoofer.caida.org/faq.php.)

The biggest issue is that there is no way for legitimate ISP's to verify that all inbound traffic is legitimate (not spoofed).

You're looking for spoofing stats? Here's the place to look: http://spoofer.caida.org/summary.php

You're wanting more info about spoofing and why it's an issue? Here's the place to look: http://spoofer.caida.org/faq.php

Also, if you're looking to test to verify that your ISP's DNS servers are not vulnerable to DNS spoofing, check out GRC's DNS Nameserver Spoofability Test: https://www.grc.com/dns/dns.htm

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.