Tcp Tutorial-17

Networking Protocols manuals and need to be able to write C programs which will help you in the

Spoofing process. It is amazing how people even think that they can spoof their IP without even knowing what TCP/IP stands for.

You see all packets travelling across the Internet have headers which contain the source and destination IP addresses and port numbers, so that the packet knows where to go and the destination knows where the packet has come from and where to respond. Now the process of Spoofing means to change the source IP address contains by the Header of the packet, in turn fooling the receiver of the Packets into believing that the packet came from somewhere else, which is a fake IP. Now let's again look at the IP Header of a datagram.

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Version| IHL |Type of Service| Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Identification |Flags| Fragment Offset | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Time to Live | Protocol | Header Checksum | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Destination Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | TCP header info followed by the actual data being transferred | |

Now to this you need to be able to guess sequence numbers which is quite a sophisticated process and I will

try to explain it as clearly as possible. Before we go on, you need to understand the fact the IP spoofing is not the entire process, it is just a stepping stop in the entire process of fooling the remote host and establishing a trust relationship with the remote host.

So how do these trust relationships take place? Well all of you are encountered with some form of authentication process or the other. Now the Username-Password pair is the most commonly used form of authentication, with which we are very much familiar. Now what happens in the Username-Password form of authentication is that the remote host to which the client is connected to challenges the client by asking the User to type in the Username and Password. So in this form of authentication, the User needs to intervened and the remote host challenges the user to enter the Username and Password which act as a from of authentication.

Now other than the Password-Username form of authentication there is yet another form of authentication most users do not know of. This is the Client IP. In this form of authentication, what happens is that the remote host gets or find out the IP address of the client and compares it with a predefined list of IP's. If the IP of the client who is trying to establish a connection with the remote host is found in the list of IP's maintained by the host, then it allows the client access to the shell 'without a password' as the identity of the client has already been authenticated.

Such kind of rust relationships are common in Unix Systems which have certain 'R services' like rsh , rlogin , rcp which have certain security problems and should be avoided. Despite the threat involved most ISP's in India still keep the ports of the R services open to be exploited by Hackers. You normally establish a Rlogin trust relationship by using the Unix command,