1

Is it possible that collision occurs when malicious user spoofs his IP to imitate legitimate user and sends IP with same src/dest/"Identification Field" values in IP's header thus causing reassembly of corrupted IP datagram? How to prevent it?

Improve this question

1 Answer 1

Reset to default
0

If an attacker is able to read IP packets because nothing prevents him to do so in the network (e.g. IPsec) then yes, he can send crafted packets with the same ID field than legitimate ones. IP does not protect this value from being read.

The attacker needs to predict what the Identification field will be in the packet if he has not seen a fragment yet or sniff it and sends a packet/fragment fast enough to be taken into account.

There is a race between the packet/fragment sent in the same time by the legitimate user and the one sent by an attacker unless the attacker is in a man-in-the-middle position and can stop and replace legitimate packets.

How fragments are reassembled are dependant of operating systems, one may prefer the first fragment that has been received with a certain offset, another might prefer the last one (first option is more common in reverse overlap cases, second is more common in forward overlap cases). A very good paper has been published years ago about it.

It is hard to detect and prevent, the same mecanisms than the ones for preventing IP spoofing could be used:

  • IPsec
  • Layer 2 protections (802.1x...)
  • Check for IP origin (filter packets from outside your network claiming to be inside)

But nothing in IP itself can prevent it.

Improve this answer
2
  • Could you elaborate more on Layer 2 protection, not very clear for me.
    – anon
    Dec 20, 2016 at 17:42
  • What you need to do to avoid IP address/ID field spoofing is basically authenticate machines in your network, you can either do that at layer 3 (network) with IPsec or at layer 2 (link) with mecanisms such as 802.1x (it is more an "over ethernet" protocol than a "link layer" one to be fair, that's a language abuse). Once users are authenticated on our network, it will be way more difficult for an attacker to fake IP packets as they probably do not have authentication keys and their packets would be discarded.
    – Jeff Bencteux
    Dec 21, 2016 at 8:58

You must log in to answer this question.