0

Although I am fairly new to the industry (3rd internship at a financial institution), I am sure most people have heard and understand the concept of spoofing information, like a sender IP, or MAC address.

My question is, how could an Analyst detect if certain information is spoofed? How could they detect that an IP is not actually the IP of the sender?

My best guess from what I have learned so far would be to look at the logs and compare the potentially spoofed information to the actual route the packets took on the network.

Improve this question
2
  • Depends what particular protocol you have in mind. If it's WWW, if you use HTTPS, browser checks whatever the certificate matches domain and that there's no-one in the middle spoofing whole website.
    – Aria
    Jul 12, 2016 at 19:52
  • 2
    Are you asking how to detect any kind of spoofing in general, or specifically about how to detect IP spoofing?
    – Anders
    Jul 12, 2016 at 20:02

2 Answers 2

Reset to default
1

Well we know that spoofing an IP address (over TCP) is highly improbable due to the three-way handshake that takes place.

On the other hand, spoofing a MAC address is a fairly trivial task. Your only detection for spoofed MACs is to look at the MAC and try to determine the manufacturer (the first three values (i.e. the three "XX"s) denotes the manufacturer in an address like XX:XX:XX:12:34:56). Note that only bad MAC addresses, in other words, MACs that don't resolve to a manufacturer, would be clear indications of spoofing. If the actor spoofs a valid MAC, this will be harder to detect.

Typical controls to mitigate spoofing include using SSL (over TLS) with a certificate signed by a Certificate Authority (CA).

Improve this answer
1
  • Cool I didn't think about the manufacturer signature detection at all, Thanks!
    – PositriesElectron
    Jul 13, 2016 at 17:57
1

@Hollowproc is correct. MACs are usually the dead giveaway, and if the MAC is spoofed, the IP is more than likely spoofed as well because of ARP. Here is an article from Cisco that really explains it well and covers areas like Spoofed Packet Detection, Tracing Spoofed IP Packets, and Countermeasures for IP Spoofing. IP Spoofing

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .