Steps to observe packet spoofing by ISPs (8)

Each IP packet is typically captured wrapped inside a link-layer header (often referred to as an Ethernet frame header or Ethernet packet header on an Ethernet-style network, including a wired Ethernet or wifi network).

Link-layer headers are used to communicate between computers on the same local Ethernet network and are discarded and regenerated whenever a packet is forwarded through any router.

Thus, there is no reason to expect link-layer headers to correspond between two packet traces unless those packet traces were captured on the same physical local-area network.

When manually performing a detailed packet comparison, packets should be considered “the same” if the Internet Protocol headers and payload match up; the link-layer headers can simply be ignored because they were never forwarded over the Internet.

Even some discrepancies between IP headers are to be expected; for example, the Time-To-Live (TTL) field is supposed to be decremented by each router that forwards a packet, so the TTL value when a packet is received should always be smaller than the original TTL value when it was transmitted.

Similarly, the IP checksum field that indicates whether a packet’s IP headers were transmitted without error has to be recalculated each time the packet is forwarded, because the TTL value has changed.

There are also other circumstances in which an ISP’s routers may, consistent with Internet protocol standards, legitimately alter other fields in the IP headers. 12.On the modern Internet, there are usually several ISPs involved in forwarding packets from their source to their destination.

ITREALMS Online ... delivering news for ICT4D