On Thu, 7 Jul 2005, Alan Cox wrote: > On Iau, 2005-07-07 at 22:12, shogunx wrote: > > Oh, I see. Someone forges headers to spoof the mirror into relaying nasty > > packets somewhere. A bit of logic in the middle of the subroutine could > > verify authenticity and if authentic, MIRROR, and if not authentic LOG > > or DROP. > > Verifying source is fairly hard except for internal network traffic.
Perhaps a quick arp lookup on the ip address indicated in the packets, and a comparison to the originating mac address's ip. Who would that exclude? Forged ip addresses. Virtual hosts, in some instances. > > The more evil version of this is to find big networks configured for old > style "respond to broadcast ping" behaviour. People then spoof packets > to the broadcast address of that network with a fake source address of > the victim, instant attack amplifier and most unpleasant. > Thats heavy duty. > Alan > > ---------------------------------------------------------------------- > For LINUX-390 subscribe / signoff / archive access instructions, > send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit > http://www.marist.edu/htbin/wlvindex?LINUX-390 > sleekfreak pirate broadcast http://sleekfreak.ath.cx:81/ ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
