0

My ip address is specified in the ip packet sent to the next node. I wonder if a device that handles this packet can modify the ip address before forwarding it to the final destination?

In theory this sounds possible, but perhaps not so likely that the ISP or another node before the final destination would do so.

What if I write my own tcp/ip messages and enter a fake ip address (let's say I don't care about the response) Will this still be sent to the final destination?

I'm wondering because I'm setting up my own server and don't want to blacklist ip addresses wildly if this is a possible scenario.

1

I wonder if a device that handles this packet can modify the ip address before forwarding it to the final destination?

Any node forwarding the packet can - in theory - modify anything in it. NAT routers translate between public and private addresses routinely.

not so likely that the ISP or another node before the final destination would do so.

Your ISP won't likely do that unless they run CG-NAT.

What if I write my own tcp/ip messages and enter a fake ip address (let's say I don't care about the response)

That's called spoofing. It might work with some transport protocols (like UDP) but certainly won't with others (like TCP).

Will this still be sent to the final destination?

Most probably.

I'm wondering because I'm setting up my own server and don't want to blacklist ip addresses wildly if this is a possible scenario.

If you're planning to set up a server on the Internet you should learn the basics.

| improve this answer | |
  • What prevents spoofing from working via TCP? – Arre Jun 7 at 20:44
  • TCP requires a threeway handshake for initialization that cannot work with spoofed addresses. – Zac67 Jun 7 at 20:52
  • Okay, so no messages are received if both can't find each other (ACK) – Arre Jun 7 at 21:02
  • The initial (spoofed) SYN reaches the destination but its SYN/ACK response goes to the spoofed address. – Zac67 Jun 7 at 21:08
  • Which will be ignored I guess? – Arre Jun 7 at 22:12
1

My ip address is specified in the ip packet sent to the next node. I wonder if a device that handles this packet can modify the ip address before forwarding it to the final destination?

That is called NAT (Network Address Translation), and it is very common. For example, nearly all home networks use Private IPv4 addressing that cannot be seen on the public Internet, so the source addresses use NAT to get a public IPv4 address.

There are various forms of NAT, the most commonly used form is NAPT (Network Address Port Translation) that also translates the TCP or UDP address (port) or the ICMP Query ID. This lets a network of hosts on a Private IPv4 network use a single public IPv4 address.

In theory this sounds possible, but perhaps not so likely that the ISP or another node before the final destination would do so.

It is increasingly common that ISPs use NAPT in order to preserve their limited public IPv4 address space for businesses willing to pay for the privilege, and forcing the NAPT on their residential customers.

What if I write my own tcp/ip messages and enter a fake ip address (let's say I don't care about the response) Will this still be sent to the final destination?

Packets are routed by the destination address in the packet header.

| improve this answer | |
  • "Packets are routed by the destination address in the packet header".: Yes. So if I modify the sender address in this header, the destination will think it's from someone else. E.g. if my server has a client connected thats sends 2 request per second for a minute, I should be suspicious. If this client is spoofing a blacklist wont help and this can easily continue from another ip. What to do? – Arre Jun 7 at 20:56
  • Unfortunately, questions about hosts/servers and what to do for that are off-topic here. You could try to ask about that on Server Fault for a business network. – Ron Maupin Jun 7 at 21:14
  • Thank you but i'll stay here – Arre Jun 7 at 22:11
  • OK, but you will not find an answer about what to do for your situation here. If you want an answer to that, you will need to ask on Server Fault. We deal with the network here, but the hosts and servers are not included in that. We can help with the network devices (routers, switches, etc.). – Ron Maupin Jun 7 at 22:46
  • I appreciate it, i'll check it out in the future – Arre Jun 8 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.