Observing packet spoofing by ISPs (11)

THIS can cause a serious discrepancy in the number of packets a host believes it transmitted as against the number of packets it actually transmitted; since packets are split up by the network card in a way invisible to the sender’s operating system, every TCP packet large enough to be split may appear to be “forged”, since the sender will have no record of having sent any of the received packets in the form in which they were received.

TCP segmentation offloading should also be disabled if your system uses it. pcapdiff, for example, is not able to ignore TCP segmentation discrepancies in the same way that it can ignore TCP and UDP checksum mismatches. See http://www.inliniac.net/blog/2007/04/20/snort_inline-and-tcp-segmentation-offloading.html for a discussion of TCP segmentation offloading’s consequences for packet sniffing, and information about disabling it on Linux.

In general, the validity of the results of packet capture experiments will be improved by disabling all available offloading features.

Step 4. Determine local IP address

Next, determine the IP address of your computer. You can obtain this locally from your computer’s network configuration tools, and you can also obtain it from a web site such as http://whatismyipaddress.com/ or http://www.whatismyip.com/, which displays the IP address from which is being accessed.

Use both methods to ensure that you are really directly connected to the Internet and not using a proxy server or NAT connection. (If you are not using NAT, your computer’s locally-configured IP address should be identical to the IP address seen by web sites and other Internet users.
(To be continued next week)

ITREALMS Online ... delivering news for ICT4D

Short URLs: goo.gl, mcaf.ee, cli.gs