Viewing Thread:
"IP Packet Creation"

Long time, no post, I know, but hopefully someone can help on this :-)

The joys of final year projects, I'm trying to conduct an experiment to prove that IP spoofing is possible. I know it is, everyone knows you can do it, but can I get it to work? Not a chance!

I've got a program, CommView, that allows you to monitor incoming and outgoing IP Packets. That works fine, (it's actually v. good, you can get a free trial version from www.tamos.com, good for spotting worms on your machine like MSBlast!).

I also downloaded a packet creation tool called Rafale X. This gives the ability to create an IP packet from scratch (apparently) and send it via my dial-up connection.

I'm not even trying to spoof my address yet, just trying to send a SYN packet to my parents machine. No data, just a port number (I've tried 8, 23 and 135 - Echo, FTP and RPC...none have worked yet).

CommView is showing the packet leaving my machine, but my parents are not receiving it on their's (they've disabled their firewall), and I'm not getting any ACK's back from their machine either.

I don't suppose Freeola (or Tiscali, my parents' ISP) could be filtering these packets somehow?

Any thoughts or ideas on this would be greatly appreciated. I also realise that people may be concerned with helping people spoofing IP addresses, so if you want to reply to me personally, my uni email is [email protected]

I have cross-posted this to the Customer Support forum.

Thanks

GL

Sending a packet to the loop-back address works - but it will not leave your computer. The machine recognises that it is a local address, so does not bother sending it over the Net.

Using a LAN would defeat the object of the exercise in this case unfortunately :-( I need to prove it is possible over the Internet. Specifically, that someone with a dial-up connection can do this.

Thanks anyway though!

I'm not overly familiar with what you're trying to do, but it's quite possible that freeola's routers are dropping your packet, because the source ip is not part of their subnet. Have you tried sending the packet to 127.0.0.1 and seeing if you get it back?

Also if you have a LAN, it would probably make things easier.

Long time, no post, I know, but hopefully someone can help on this :-)

The joys of final year projects, I'm trying to conduct an experiment to prove that IP spoofing is possible. I know it is, everyone knows you can do it, but can I get it to work? Not a chance!

I've got a program, CommView, that allows you to monitor incoming and outgoing IP Packets. That works fine, (it's actually v. good, you can get a free trial version from www.tamos.com, good for spotting worms on your machine like MSBlast!).

I also downloaded a packet creation tool called Rafale X. This gives the ability to create an IP packet from scratch (apparently) and send it via my dial-up connection.

I'm not even trying to spoof my address yet, just trying to send a SYN packet to my parents machine. No data, just a port number (I've tried 8, 23 and 135 - Echo, FTP and RPC...none have worked yet).

CommView is showing the packet leaving my machine, but my parents are not receiving it on their's (they've disabled their firewall), and I'm not getting any ACK's back from their machine either.

I don't suppose Freeola (or Tiscali, my parents' ISP) could be filtering these packets somehow?

Any thoughts or ideas on this would be greatly appreciated. I also realise that people may be concerned with helping people spoofing IP addresses, so if you want to reply to me personally, my uni email is [email protected]

I have cross-posted this to the Customer Support forum.

Thanks

GL