Would the location of an Intrusion Detection (or Packet Analysis) sensor on an internal network impact whether the external host's Source IP (assuming inbound TCP traffic) is retrievable from a packet?

Put differently, is there a common deployment scenario in which sensor placement would mean constantly seeing an internal IP as the source rather than the actual external host from which the traffic originated?

(yes, I know how dicey attribution gets--I mean the last sending host).

  • This looks not really like a question regarding IDS but more like a general question on how networks work and what part of packets gets changed due to routing etc. Also a question regarding the source address is more at the level of packet filters and not the deeper inspection done by IDS. Thus I think this is off-topic here. – Steffen Ullrich Mar 1 '16 at 20:22

It depends on how your network is setup; but usually the IP is not stripped and the packet headers contain the original source and destination.

Generally, a core switch comes after a router, the router is likely on an enterprise network to be doing a lot of NAT translations. In which case, you may see the NAT IP of a given packet be referenced (e.g instead of some public ip, you see 192.168.x.x). So it's likely you will see the internal IP as a source of anything outbound, because, that's the only IP the network device knows about -- the external IP is applied by the router doing NAT.

However unless you're doing some strange (e.g. Cisco fix-up) packet-level inspection and changing, the packet headers should remain the same and indicate the source and destination IP of the endpoints -- not of any intermediate network devices that carry the traffic. Those devices only have management IPs -- and don't tend to (although this can happen in sophisticated layer 3 switching setups which are uncommon) alter the packet headers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.