The Doctor
1 min readDec 27, 2016

--

Routing:

Packet is generated with source (192.168.1.2, for example) and destination IP addresses (the destination IP is not in the local netblock — say 10.0.0.15). Packet hits the wire, destined for the IP address with the default route (0.0.0.0). The router looks at the source IP and sees that it came in on an interface with an IP address in the same netblock (192.168.1.1). The router doesn’t have an interface with an address in the 10.0.0.0 netblock but knows that it can forward it one hop toward its destination by sending it out of its default interface (192.168.2.2). The next router downstream goes through the same process.

Spoofed packet:

Packet is generated with source (8.8.8.8, for example) and destination IP addresses (the destination IP is not in the local netblock — say 10.0.0.15). Packet hits the wire, destined for the IP address with the default route (0.0.0.0). The router looks at the source IP and sees that it did not come in on an interface with an IP address in the same netblock (its address is 192.168.1.1, the packet’s source IP is 8.8.8.8). The router sees a mismatch and, if it’s forgiving drops the packet. In a corner case, the misconfigured router forwards the packet but the next router downstream drops it, because the source IP doesn’t match the IP of its interface and that means a misconfiguration at best, malice at worst (because misconfigured routers can take down entire networks, so filtering prevents damage).

--

--

The Doctor

Medium seems to be for people who only write for money, not for fun. Visit my website instead. https://drwho.virtadpt.net/