Tcp Tutorial-15

protect his system from IP spoofing


So what is IP Spoofing? IP Spoofing is a trick played on servers to fool the target computer into thinking that it is receiving data from a source other than you. This in turn basically means to send data to a remote host so that it believes that the data is coming from a computer whose IP address is something other than yours. Let's take an example to make it clear:

Your IP is : 203.45.98.01 (REAL) IP of Victim computer is: 202.14.12.1 (VICTIM) IP you want data to be sent from: 173.23.45.89 (FAKE)

Normally sitting on the computer whose IP is REAL, the datagrams you send to VICTIM will appear to have come from REAL. Now consider a situation in which you want to send a datagram to VICTIM and make him believe that it came from a computer whose IP is FAKE. This is when you perform IP Spoofing.

The Main problem with IP Spoofing is that even if you are able to send a spoofed datagram to the remote host, the remote host will reply not to your real IP but to the Fake IP you made your datagram seem to have come from. Getting confused? Read the following example to clear up your mind.

Taking the same IP's as in the last example, consider the following scenario. Now, if REAL connects to VICTIM, after the standard three way handshake has taken place, and VICTIM sends an ACK message to REAL. Now if you spoof you IP, to say FAKE, then VICTIM will try to establish a TCP connection and will send an ACK message to FAKE. Now lets assume that FAKE is alive, then as it had not requested the ACK message (sent by VICTIM to FAKE) it will reply with a NACK message which would basically end the connection and no further communication between FAKE and VICTIM would take place. Now if

connection times out.