Reading about the tool hPing, it is possible to spoof an internal address, on the detection side of this how would one go about detecting this? are there tell-tail signs?

EDIT: thinking about it, you could use the MAC Address of the Internal IP, but are there other ways??

1 Answer 1


There are a couple of things to think about with your question.

First, you mention "spoof an internal address". Assuming you mean spoofing a reserved 10.a.b.c or 192.168.a.b private address space, how do you plan to get the packet into the victim's network? Those are "non routable" addresses, meaning that no internet router knows where to send a 10. address. This includes your home router, which will not send 10. packets onto the internet in the first place. For this attack to work, you must already be inside the victim's network.

Now let's assume you're successfully attacking from within the internal network. Yes, you can spoof a source IP, but how are you going to see the response? The response will be sent to the real IP, not to your machine. To solve this, you'll have to take over the real address. This can be done using a technique like ARP cache poisoning. And ARP attacks are detectable with certain kinds of network monitoring tools, so this is not guaranteed to be an entirely invisible attack.

Another option would be if your machine is on the same subnet as the victim machine, and you have full access to the network switch. Most managed switches allow the creation of a "mirror port" to capture packets for network monitoring tools. You could theoretically use data from the mirror port to see the replies and mount your attack; but be aware that this will still be delivering those reply packets to the victim's computer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .