how can u tell a spoofed ip?

Printable View

January 20th, 2002, 07:42 PM
Ivan Kozhedub

how can u tell a spoofed ip?

hi, i'm a forum moderator and am a little suspicious of a recently joined member..
he has stated he is from israel and has provided an email addy ending in .il that has not returned any undeliverable messages as of yet since i mailed it...

run his ip through visualroute and that also appeared to come from a dial up connection in israel...

would it be quite easy to spoof this stuff using some kind of proxy or any other means?

and is there any tell tale signs that i could look for if there is ?

thanks.
January 20th, 2002, 09:36 PM
Ron the don

spoffski

I got these links out of Maximum Security

Though i haven't checked them all, might help you out a little ;)

http://all.net/journal/netsec/9606.html

http://www.fc.net/phrack/files/p48/p48-14.html

http://www.nwc.com/unixworld/security/001.txt.html

http://www.netsurf.com/nsf/v01/01/local/spoof.html

(just randomly quoting now) :)

*NetVision Synchronicity for windows NT.
Ant-spoofing support is built in, check it out here
http://www.netvision.com/products/synchronicity.html

*Cisco PIX Firewall.
PIX is Cisco's premier internet Bxsecurity product and is a full fledged firewall with built in anti-spoofing capabilities.
http://www.cisco.com/warp/public/cc/pd/fw/sqfw500/

+ just wondering when you use proxies say on a webpage with a form mail you can forge your ip right? but if your using an app then it uses the logged on ip ?
January 21st, 2002, 11:42 AM
Ivan Kozhedub

thanks for those links ron, had a quick look and they look a little long winded for me as i only have limited kwnoledge of computer security, however i will spend some time reading through them today and try to understand them as best i can...

cheers:)
January 22nd, 2002, 01:54 AM
Ron the don

knowledge is power

If you want to learn more about security i have a small collection of texts for download
(all zipped into two zip files, saves surfing page by page)

;)

8.77 mb
http://charlatanz.tripod.com/TEXTS2.zip

8.45mb
http://charlatanz.tripod.com/TEXTS1.zip

have fun
January 22nd, 2002, 07:27 AM
8*B@LL

Re: how can u tell a spoofed ip?

Quote:

Originally posted by Ivan Kozhedub
would it be quite easy to spoof this stuff using some kind of proxy or any other means?

trivial to get the ip if he found an open proxy. the email addy would be a little harder, but not that bad if he could find a free email provider over there.

Quote:

and is there any tell tale signs that i could look for if there is ?

not unless you talked to the ISP and asked them to check for open proxies on their servers, but that would be kinda impracticle considering the language barrier. even if he is lying, i fail to see the problem with it. what's the big deal if he is? if he's a big enough loser to have nothing better to do than find an open proxy in isreal, then get an email address there JUST so he can go to a forum and clame to be from there, i say let him go. its probably the only thrill he has in his non-existant life. if there is some good reason, please enlighten me, but i cant seem to find one right now.
January 22nd, 2002, 04:21 PM
Ivan Kozhedub

thanks a lot for your easy to understand comments, after spending a bit of time checking things out and talking to him i now belive him to be genuine..

its quite important that i know this though as it is a forum for a group of us that play an online flight sim kind of thing and we go into battle against other squads, we take it quite serious though and i have even known players enroll into another team under alias just to steal tactics from their forum..LOL, hence my post in here.. :)

Thanks a lot for your help though, i vist here quite a bit but i dont post much cos i dont know much, some very interesting reading to be done though :)

ty, cyas later..
January 22nd, 2002, 05:25 PM
comJo

PGP Anyone?

If you take it seriously @ all, assume that you are the only person in your 'team' that is authentic. Require all team members download and run PGP. Learn PGP and give only members you are convinced are authentic your keys.

OverandOut.
comJo
January 22nd, 2002, 07:21 PM
8*B@LL

Re: PGP Anyone?

Quote:

Originally posted by comJo
If you take it seriously @ all, assume that you are the only person in your 'team' that is authentic. Require all team members download and run PGP. Learn PGP and give only members you are convinced are authentic your keys.

um, i dont know if your a gamer or not, but that would kinda defeat the purpose :)
when you game in a clan(squad, whatever you wanna call em, i guess clan is mainly FPS games), the point is to have a whole team practice and work together to go against other teams in an orginized fassion, as oposed to just public gaming where the play is often quite un-orginized. if you took sombody into your clan(squad), then didnt share your strats and such with them, they would be useless to the clan(squad) and may as well just be tossed out :)