Re: Re: Re: Re: is IP# in $ENV{REMOTE_ADDR} spoofable?

[jepri]

I'm afraid that this is incorrect. You can't change horses midstream in a TCP connection. I've tried it and the connection locks up. The trick is that in order to open the connection, both parties must reveal their true IP, or the connection won't open. The TCP connection build-up works like this:

• The initiator of the session sends a segment with the SYN flag set to the recipient.
• Upon receipt of the segment, the recipient sends a SYN segment to the initiator with the ACK number set to the sequence number + 1, and sets new sequence number for its own end.
• The initiator then sends an ACK of its own in response to the recipient's SYN, with the ACK number set to the recipeint's sequence number + 1.

After these steps are completed, no data has been transferred, the connection is open, and both parties know the correct address of the other party. If one party fakes the address the connection will jam. This is the now-famous 'syn attack'.

This is how you are able to find out the remote IP address when you do a $socket->accept call to receive an incoming connection.

As I mentioned earlier (because I knew it would get brought up), it is possible to spoof ICMP packets, because ICMP does not build a connection like TCP does.

Also, earlier versions of windows can do raw sockets (otherwise they couldn't do any networking at all), but their native libraries don't have a API for raw sockets. There are libraries for these systems to provide raw sockets though.

____________________
Jeremy
I didn't believe in evil until I dated it.