I tried to send a udp packet with fake source Ip(no evil, i am not a attacker;),but i was failed. I seems that the router of the datacenter censor the packets and drop it; who can taught me how to make it?
Cool, I used to do this by spoofing udp packets from 3.3.3.3 from the client to the servers public up, but was unreliable due to anti spoofing filter. This way is better
You can't drop the original traffic using the library. You could capture it, modify it and send it though. That + some iptables rules to drop the original traffic would be sufficient I guess.
You could probably via ebtables as they inspect ethernet frames directly. That can be used for example to not allow VMs on host to spoof mac addresses.
But easiest way is just don't allow app to run with permission to access raw socket. That's it.
The problem is really that there is no way to get UDP interface that also gives you mac address of the packet so raw sockets are only way to do it.
Similarly there is no interface to send ICMP packets other than raw sockets.
Well I did post the source port, which reduces the effort by a factor of tens of thousands... also, the up-thread did say "with a single fake RST or FIN packet"... which is why I mentioned window guessing...
Also, crap, I'm an idiot. Let me do that non-natted ;)
tcp 0 0 216.240.155.220:4007 60.225.131.226:43972 ESTABLISHED 18694/nc
I think it would be more clever to use an actual valid TCP connection and hide the data in the fragment sizes, timing, push flags, and other various legal flags and options available. This doesn't let you mask your source, but it allows two way communication.
Server sends constant icmp pings with fixed payload to unreachable dead Internet IP. Client sends icmp time exceeded message to server containing original fixed ping subpayload, which the server NAT lets through because the payloads match as related traffic. Server then learns client IP and usual chownat udp hole punching tricks apply.
Although, I'd have done it differently. using some packet capture tools, fake replies with the various different IP addresses. That way you don't even have to run a physical router that bounces it back and forth.
You can send spoofed packets from nearly every host.
However hosts like Ecatel are known to specifically allow their customers to send spoofed packets at full speed 24/7.
I think most hosts will notice heavy bandwidth usage, investigate, and then terminate your account. This is why people buy servers at Ecatel even if it is more expensive.
Can you clarify, does that works on the forwarded packets? I assume it should, given the vuln in the scrubbing function, but it would help if that would be stated clearly.
reply