0

i'm trying to understand more advancedly on how we can prevent an ip spoofing . since its impossible to know the original mac adress of a spoofed retour how we can check for example if the packets we sent or we received are going/coming from the retour (192.168.0.1) ? .

for example is it safe to determine that the seconde call of an Arp request is fake ? because it makes no sense after the first arp request the retour have its table set up and ready to go why will it sent more arp requests every time ?

if not , most of time a the source IP does not belongs to the spoofer his self so we cannot ping , is it safe to determine that its a fake packet ?

and if we can ping the source ip its source hostname is up and running how we can find out that the packet being sent or received is fake ?

I'm trying to understand more about spoofing i might have some missunderstanding of some concepts so excuse me for any confusing terms !

1

1 Answer 1

1

how we can check for example if the packets we sent or we received are going/coming from the router (192.168.0.1)

You could hard-code the (MAC-address, IP-adress) mapping of the router and throw away packets claiming to come from the router's IP that didn't match the mac-address.

Most likely, nothing else will work reliably. However, fixing the MAC-address of the router will likely cause maintenance problems.

is it safe to determine that the second call of an ARP request is fake?

Not necessarily. ARP tables are repopulated periodically. Hardware might be exchanged, explaining MAC-address changes.

so we cannot ping , is it safe to determine that its a fake packet ?

No. Just because you can't ping a host doesn't mean it doesn't exist, or isn't real. It's firewall - or any firewall along the route - might simply discard ping requests.

Also, ping works above the ethernet level, so if someone successfully steals an IP-address on your network segment by poisoning arp caches / switches, he won't have any trouble replying to your ping. Basically, ping is worthless as an authentication method.

and if we can ping the source ip its source hostname is up and running how we can find out that the packet being sent or received is fake

Set up an authentication protocol. If the host successfully authenticates to you, you know it's the real thing. If it can't, it's a fake. However, this doesn't work on the IP level - you'd need to build the authentication into an application level protocol, or use a preexisting one, such as TLS.

2
  • You could hard-code the (MAC-address, IP-adress) mapping of the router and throw away packets claiming to come from the router's IP that didn't match the mac-address. , so by Impersonating the retour (192.168.0.1) the mac adress still cannot be Impersonated atleast in the most of cases ?
    – Huster
    Jun 26, 2017 at 2:02
  • It can, but if you spoof the mac address, you won't get an answer to the spoof packets, unless you get control over the software of the switch. Jun 26, 2017 at 7:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .