0

I am learning about Ingress Filtering where unauthorised packets are filtered out from entering the network.

To get a better understanding of it , I found an article which said:

the system examines all incoming packets to get information about their origins. The system compares this information to a database to determine if a packet is indeed from the place it says it is. If it appears to be a match, it can be allowed through. If there is a problem with the source, the system can hold the packet, keeping it out of the network and protecting any users who might be attached to the network.

I understand that if the spoofed packets are from a source address which is not in the database , it will not be allowed to enter the network.

HOWEVER

Assuming a hacker spoof a source address which can be found in the database , when the system compares this information to the database information , a match will be found and the packet will enter the network though it has been spoofed.

I am wondering if the system is able to detect packets which has been spoofed with IP source address which could be found in the database and if yes how are such packets detected ??

EDIT : It appears the term "legitimate" and "illegitimate" has been causing alot of confusion so I have changed it to source address found in the database and source address not found in the database. I hoped this has made the question easier to understand

  • Spoofing implies some level of undesirable action. As a Network Engineer, a packet coming from a network that hasn't been allocated to them is a bad thing. What legitimate reason would a downstream network have for sending a packet sourced from something other than what it's been assigned? As a customer network, why would you want traffic sourced from your network entering your network's edge? – Ryan Foley Nov 28 '14 at 17:20
  • @RyanFoley my apologies , what i meant was that a hacker spoofed a legitimate source address – Computernerd Nov 28 '14 at 17:23
  • @RyanFoley What i mean is what if the hacker spoofs the source address so that the packets "originates" from etc Google servers and Google servers happen to be in the database. – Computernerd Nov 28 '14 at 17:35
  • Did any of the answers help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively you can answer your own question and accept the answer. – Ron Maupin Aug 6 '17 at 2:46
3

If a hacker spoofs packets which match your SRC/DST fields at any line in an ACL, then the firewall is going to allow the traffic.

The only exception to this is if you have a stateful firewall, and the spoofed packets don't make 'sense' for the given conversation the firewall is tracking. An example of this would be a hacker spoofing tcp syn's to a host that's already mid-conversation with the real source IP. The firewall would see this behavior and drop the packet. This doesn't apply if there's no session already being tracked by the firewall, so again the cases in which a stateful firewall is going to completely block all spoofed packet is situational at best.

There are exceptions for both stateful and stateless firewalls, but being general it's hard to give you more (useful) detail.

You can however design ACL's in way that can detect spoofed IP's in certain situations. For instance, you could have an edge firewall, and you know logically only public IP's will be coming from the outside to your network, so you could create ACL's blocking all of the private IP space from the outside, and that could stop some spoofing attempts.

In similar veins you could do this for networks you know will not be coming inbound to the interface you're making the ACL for, and so poor spoofing attempts would be stopped.

There are many tools that need to work in concert with a firewall to protect against spoofing attacks, but the best any engineer can do is look at the firewalls placement in their network and design ACL's that factor in which traffic should logically ever be allowed to pass through a given interface.

If you need more detail let me know and I'll reword the answer for you!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.