Steps to observe packet spoofing by ISPs (4)

Current Unix, Windows, and MacOS operating systems all allow you to start the ping process by typing ping 4.8.16.32 at a terminal (command-line) prompt. (On some systems, the ping will stop automatically after a predetermined number of pings; on others, you can interrupt it by pressing Ctrl+C.)

If both ends of the connection are capturing data, the ICMP packets that represent ping requests and replies should appear in the Wireshark window at each end.

These packets should be identical at the IP layer and - unless the ping utility itself reported packet loss - there should be an identical number of packets seen from both ends.

This test will show if the capture process is set up and working properly.

Here, we see how the capture process appears at both ends following a large number of ping requests from 12.13.14.15 to 4.8.16.32.

The packets displayed agree one-to-one (as could be verified by looking more closely at the packets’ contents than we do here); there are no dropped packets and no spoofed packets.

(Note that you can’t see this view from both ends in real-time; this screen shot was created after the fact by copying a saved capture file from one computer onto another.

While the capture is running, each party sees only one of the two windows displayed here; in order to verify that the packet captures correspond properly while they’re in progress, you’ll need to use some other means of communication to talk to the person at the other end ….

ITREALMS Online ... delivering news for ICT4D