Problem- Solution Text (Tewodros Geberehana)
IP spoofing attacks and the recommended solutions
Ip (Internet Protocol) spoofing attacks are one of the types of attacks being done on computer systems.
IP is the rule that governs how communication is done for systems to communicate with each other
thereby using similar types of communications methodology .IP is the basic protocol that is used for
communication between computers that are connected either locally or globally [1][2]. IP address
spoofing or IP spoofing refers to creation of IP packet with fake source IP addresses, for the purpose of
hiding one’s identity or Malicious purpose [1].IP packets consists of headers that describes the different
sections like the sender IP address, the receivers’ address , the data to be sent and so on. Therefore, an
IP address spoofing is done with the manipulation of the headers in the IP packet [2].
Figure1.The IP Header source [3]
As can be seen in the figure the IP header contains around 14 fields in which source and destination
addresses are part of the header. The source IP address is used so as to identify the sender of the IP
packet and the destination address to identify the one the message is intended for. Since IP protocol do
not has a way to verify that the source address is generated by the sender an attacker will use this
weakness of the protocol to modify the source IP address of the packet that is being intercepted [3].
IP spoofing is usually done for the purpose of denial of service attacks [1].denial of service attack which
is also termed as distributed denial of service, is a type of attack with the intent of making a computer
resource unresponsive or unavailable from intended users by attacking the system [1] .In Dos attack the
system will be overwhelmed with unexpected amount of IP traffic, with Spoofed IP packets, so as to
degrade the performance of the system and making it finally unresponsive. To overwhelm a system an
attacker can randomly choose source Ip address and flood the destination with traffic. IP spoofing can
also be used to gain unauthorized access , one example for this is on systems that has trust among each
other in corporate level and use IP address as an authentication(verification of intended users)
methods[1][2].
IP Packet Filtering is one of the ways to protect the Ip spoofing in a network [1].there are two
types of packet filtering mechanism called ingress and Egress filtering that can be done at the gate
of the network .Ingress filtering is a type of filtering that will prohibit any type of outside packets that
will try to come in to the network using its source address as one of the inside systems. Egress
filtering will prohibit any type of packet that will try to leave the network using the source address
that does not belong to the inside system .Therefore, by implementing the egress and ingress
filtering on to a firewall (a guard against intruders for network) it might be possible to protect the
network against spoofed IP packets. Though it is possible to do a great contribution using ingress
and egress against IP spoofing ,an attacker might be going to use some external address that can
bypass the ingress filtering, since source address is not as the inside systems. As a result it is better
to protect the IP packet using high level protection mechanism called secure shell (SSH) and secure
socket layer (SSL).both SSH and SSL can protect the IP packet that is transmitting from being
intercepted by outsiders/intruders.
IP spoofing is one the attack that is being done in a network of systems and has been a threat for some
time. The attack usually has a malicious purpose and could be done through hiding identity by faking
source IP address. Sometimes spoofed packets are more difficult to filter since each spoofed packet
appears to come from a different address[2] .As mentioned above it is better to do protection on higher
level using SSH and SSL so as to protect the IP packet from being modified by Intruders.
References,
[1]. Name Wikipedia Title IP addresses Spoofing
Address => http://en.wikipedia.org/wiki/IP_address_spoofing
Date accessed 15 February 2011
[2].Name Topbits.com
Title IP addresses Spoofing
Address => http://www.tech-faq.com/ip-address-spoofing.html
[3]. Name Cisco Title IP spoofing
Address => http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_10-4/104_ipspoofing.html