Subject: [RPSEC] IP spoofing threat

From: "Mohammad Awad" <[email-masked]>
Date: Sun, 23 Mar 2003 06:32:34 +0200

Hi all,
Regaring the IP spoofing threat,
1- If an attacker has chosen to send packets with a forged source IP address 
(e.g. 207.1.1.1), which genuinely belongs to another existing host (not 
among the attacker's subnet), is he then able to perpetrate any spoofing 
attack to the routers in order to be able catch back the replies that would 
of course be targeted to the legitimate host of the address (207.1.1.1)?
2- If Answer#1 is yes, how likely could such an attack happen taking into 
consideration the level of security already implemented nowadays in the 
intermediate routers?
3- Is there any reported incidents at CERT or any other publisher's telling 
the stories about similar attacks?
thank you all, in advance.
Moh. Awad

_________________________________________________________________
Tired of spam? Get advanced junk mail protection with MSN 8. 
http://join.msn.com/?page=features/junkmail

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stephen Kent <[email-masked]>
Date: Tue, 25 Mar 2003 10:48:04 -0500

At 6:32 AM +0200 3/23/03, Mohammad Awad wrote:
>1- If an attacker has chosen to send packets with a forged source IP 
>address (e.g. 207.1.1.1), which genuinely belongs to another 
>existing host (not among the attacker's subnet), is he then able to 
>perpetrate any spoofing attack to the routers in order to be able 
>catch back the replies that would of course be targeted to the 
>legitimate host of the address (207.1.1.1)?
>2- If Answer#1 is yes, how likely could such an attack happen taking 
>into consideration the level of security already implemented 
>nowadays in the intermediate routers?

we ought not rely on the correct operation of other routers to 
protect us, i.e., we ought to be able to deal with Byzantine attacks.

Steve