Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP Spoofing

idea.popcount.org

Post reply on HN
Print view View original

11–20 of 136 posts

Re: IP Spoofing

#11

Post by mordocai »

zmanian wrote: post #8

Netflow is a great example of the dual use aspects of tech between surveillance and defense. Making Netflow data more widely available looks like it is going to be essential for defending that Internet but at the same time Netflow data can threaten the anonymity of Tor users.[0][1] [0] https://blog.torproject.org/blog/traffic-correlation-using-n... [1] https://gitweb.torproject.org/torspec.git/tree/proposals/251...

Of course, I'm not sure if cloudflare could care any less about tor users. They see a lot of attack traffic from tor so this probably isn't something they are concerned about. I can't really blame them from a business perspective, but I avoid cloudflare due to it.

Re: IP Spoofing

#12

Post by majke »

Thaxll wrote: post #7

UDP spoofing is one thing but the latest and largest attacks are TCP based.

This is a bold statement.

First, one can spoof udp packets in the same way as tcp segments. Think syn or ack floods.

Second the Krebs ddos is said to generate over 600 gigs of traffic but it was not necessarily with fully established tcp connections. It's unlikely it was with valid tcp connections.

Let me give you a thought experiment: if you are flooded with 600 gigs of forged tcp packets, how do you know if the source ip's are spoofed or not? How do you know the ip in the src ip field belongs to the one that originated the packet?

Re: IP Spoofing

#13

Post by amluto »

lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

I used to have a regular retail network connection at the office (local DSL carrier, not some industrial-grade expensive fiber thing) that allowed spoofing. The office was multi-homed (we had a second connection from a different provider for redundancy -- it turns out that our major local incumbent provider had maybe one nine of availability), and the results were hilarious. It turns out that, because Linux considers IP addresses to belong to a computer and not to an interface, it's fairly easy to (mis-)configure things so that traffic with a source address belonging to one interface goes out the other interface. This, coupled with spoofing being allowed, meant that we sometimes accidentally spoofed ourselves, and it worked! We went for surprisingly long times without noticing that some of our TCP connections went out one pipe and back in the other.

If I remember right, we would only notice it when we were confused by packet captures, when we had strange performance problems, or when we'd discover that we suddenly had two single points of failure. :)

Re: IP Spoofing

#14

Post by jacquesm »

lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

That would penalize a whole pile of parties that probably have nothing whatsoever to do with the spoofers. It's akin to blackholing mail from yahoo.com because there are spammers on yahoo.com.

Re: IP Spoofing

#15

Post by dom0 »

mordocai wrote: post #11
zmanian wrote: post #8

Netflow is a great example of the dual use aspects of tech between surveillance and defense. Making Netflow data more widely available looks like it is going to be essential for defending that Internet but at the same time Netflow data can threaten the anonymity of Tor users.[0][1] [0] https://blog.torproject.org/blog/traffic-correlation-using-n... [1] https://gitweb.torproject.org/torspec.git/tree/proposals/251...

Of course, I'm not sure if cloudflare could care any less about tor users. They see a lot of attack traffic from tor so this probably isn't something they are concerned about. I can't really blame them from a business perspective, but I avoid cloudflare due to it.

> They see a lot of attack traffic from tor

This was debunked.

Re: IP Spoofing

#16

Post by brainfire »

dom0 wrote: post #15
mordocai wrote: post #11

Earlier quoted context omitted.

Of course, I'm not sure if cloudflare could care any less about tor users. They see a lot of attack traffic from tor so this probably isn't something they are concerned about. I can't really blame them from a business perspective, but I avoid cloudflare due to it.

> They see a lot of attack traffic from tor This was debunked.

Where/how?

Re: IP Spoofing

#17

Post by IgorPartola »

I have used IP spoofing for good in the past: I had a large number of sensors reporting real time data to our servers. As we wanted to migrate to a completely new infrastructure we wanted to have replication from the old servers to the new. Instead of setting up some kind of higher level system, I wrote a tiny service in C which received the datagrams and then re-sent them to the new servers but spoofed the source IP so it matched the sensor. This worked incredibly well, and the tool was later used for various other purposes.

Of course toward the end of it I learned that I could have done this all with iptables, but I like my way better because I got to learn a lot.

Re: IP Spoofing

#18

Post by illumin8 »

lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

This sounds great in principle, but it breaks down in practice. From the article, 27% of ISPs still allow spoofing on their networks. This is mostly due to them being smaller, regional ISPs without the expertise or staff to figure out how to do this.

I hear you saying "just blackhole them until they figure it out," but it's not that easy. In many cases, the small regional ISP is the customer of a larger ISP, who is the customer of an even larger global ISP that you are connected to. You just see XXXgbps of traffic coming from your ISP, and have no idea which one (or more) of their customer's customer's are sending the traffic.

This would be like saying "just don't let the one guy that's going to pee in the pool swim." How do you know which of the 200 people in the pool actually peed?

Re: IP Spoofing

#19

Post by mordocai »

dom0 wrote: post #15
mordocai wrote: post #11

Earlier quoted context omitted.

Of course, I'm not sure if cloudflare could care any less about tor users. They see a lot of attack traffic from tor so this probably isn't something they are concerned about. I can't really blame them from a business perspective, but I avoid cloudflare due to it.

> They see a lot of attack traffic from tor This was debunked.

I don't believe this is actually arguable. People use tor to attempt to anonymize their (generally non-ddos) attacks.

I don't believe tor can support the type of ddos the OP is talking about, of course.

If you could provide the source of this debunk it'd be appreciated.

Re: IP Spoofing

#20

Post by majke »

illumin8 wrote: post #18
lossolo wrote: post #3

There is no excuse for not securing your network to allow spoofing from it. Most of the big players like leaseweb or ovh do not allow that. But there are some providers that still allow you to spoof source ip address. There should be consensus about droping routes on BGP level to networks that send packets with source ips that they do not announce. It's really simple to drop packets on switches/routers that do not or…

This sounds great in principle, but it breaks down in practice. From the article, 27% of ISPs still allow spoofing on their networks. This is mostly due to them being smaller, regional ISPs without the expertise or staff to figure out how to do this. I hear you saying "just blackhole them until they figure it out," but it's not that easy. In many cases, the small regional ISP is the customer of a larger ISP, who is t…

You use netflow to identify the offender of course!
Post reply on HN