Steps to observe packet spoofing by ISPs (10)

If you’re certain that a pcap file or set of pcap files you’ve made does not contain sensitive personal information - recalling our earlier warning that it may, by default, contain a record of all Internet activity your computer performed while the capture was active - you can consider sharing pcap files with an ISP as part of a problem report or support request, or publishing them on a blog or web site when documenting a problem you’ve experienced.

These files are concrete, useful evidence that can help technically knowledgeable people diagnose network problems and confirm that a problem such as packet spoofing by an ISP is really occurring.

EFF is developing a tool called pcapdiff to help automate the process of comparing large pcap trace files that were made simultaneously at each end of a connection.

This automation makes it easier to find packet spoofing or tampering when one doesn’t know what to look for ahead of time and could make the comparison process less tedious (considering that many communications involve thousands of packets or more, and not all tampering will have results as obvious as TCP RST injection).

The pcapdiff program is a command-line utility written in Python which requires exactly two pcap packet traces; it automatically compares them to find discrepancies indicating dropped and spoofed packets.

You can download pcapdiff from . Your computer must already have the Python interpreter installed; if not, you can obtain it from http.

ITREALMS Online ... delivering news for ICT4D