Sciweavers

DISCEX
2003
IEEE

Detecting Spoofed Packets

13 years 9 months ago
Detecting Spoofed Packets
Packets sent using the IP protocol include the IP address of the sending host. The recipient directs replies to the sender using this source address. However, the correctness of this address is not verified by the protocol. The IP protocol specifies no method for validating the authenticity of the packet’s source. This implies that an attacker can forge the source address to be any desired. This is almost exclusively done for malicious or at least inappropriate purposes. Given that attackers can exploit this weakness for many attacks, it would be beneficial to know if network traffic has spoofed source addresses. This knowledge can be particularly useful as an adjunct to reduce false positive from intrusion detection systems. This paper discusses attacks using spoofed packets and a wide variety of methods for detecting spoofed packets. These include both active and passive host-based methods as well as the more commonly discussed routing-based methods. Additionally, we present the r...
Steven J. Templeton, Karl E. Levitt
Added 04 Jul 2010
Updated 04 Jul 2010
Type Conference
Year 2003
Where DISCEX
Authors Steven J. Templeton, Karl E. Levitt
Comments (0)