Observing packet spoofing by ISPs (6)

High rates of packet loss could be caused intentionally by an ISP as a means of reducing the performance of a targeted application or protocol, but they can also occur as a result of congestion on the network or other technical problems.

When a packet is lost (also called a “dropped packet”, “dropped frame”, or “dropped segment”), it is not received by the destination at all.

Some higher-level Internet protocols include mechanisms for coping with packet loss, such as TCP’s mechanism for explicitly retransmitting data from packets that are lost.

Reordering:

Sometimes packets are not delivered in the same order in which they were originally transmitted.

If packet B was transmitted after packet A, receiving packet B at the other end does not mean that packet A has been dropped; it might still be on its way.

TCP can also generally correct for reordering. Like packet loss, reordering could be used intentionally by an ISP to degrade an application, but also occurs normally in the course of Internet routing.

Spoofing:

Spoofing or packet injection occurs when an entity other than one of the endpoints generates traffic using the source address of an endpoint.

Spoofing is the most straightforwardly detectable means of interference with Internet traffic because it produces concrete evidence in the form of the anomalous spoofed packets, and because it does not occur normally in traditional Internet routing.

Spoofing can be detected by looking for packets that were received by one end but never sent by the other end.

If user B receives a packet apparently from user A that user A has no record of having sent, user B can conclude that someone in between the two has spoofed this packet.

ITREALMS Online ... delivering news for ICT4D

Short URLs: goo.gl, mcaf.ee, cli.gs