loading...
 This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
DARPA Information Survivability Conference and Exposition - Volume I
Detecting Spoofed Packets
Washington, DC
April 22-April 24
ISBN: 0-7695-1897-4
Steven J. Templeton, U.C. Davis
Karl E. Levitt, U.C. Davis
Packets sent using the IP protocol include the IP address of the sending host. The recipient directs replies to the sender using this source address. However, the correctness of this address is not verified by the protocol. The IP protocol specifies no method for validating the authenticity of the packet?s source. This implies that an attacker can forge the source address to be any desired. This is almost exclusively done for malicious or at least inappropriate purposes. Given that attackers can exploit this weakness for many attacks, it would be beneficial to know if network traffic has spoofed source addresses. This knowledge can be particularly useful as an adjunct to reduce false positive from intrusion detection systems. This paper discusses attacks using spoofed packets and a wide variety of methods for detecting spoofed packets. These include both active and passive host-based methods as well as the more commonly discussed routing-based methods. Additionally, we present the results of experiments to verify the effectiveness of passive methods.
Citation:
Steven J. Templeton, Karl E. Levitt, "Detecting Spoofed Packets," discex, vol. 1, pp.164, DARPA Information Survivability Conference and Exposition - Volume I, 2003
Usage of this product signifies your acceptance of the Terms of Use.