Steps to observe packet spoofing by ISPs (11)

Future versions of pcapdiff may be able to run without pcapy.
pcapdiff is run from the command line; you must specify two pcap trace files and the local IP address of the computer where each was captured.

In addition to producing statistics about overall rates of packet dropping and spoofing, pcapdiff will produce a list of the IP identification field values of each such packet.

This can help you locate packets of interest in a program like Wireshark much more quickly. For example, if pcapdiff says that a packet with IP identification value 4321 was spoofed in the outbound direction, you can enter the display filter ip.id eq 4321 into Wireshark’s display filter field and see only the packet (or packets) with this particular IP identification value.

Typically, IP identification values uniquely identify IP packets transmitted by a particular computer, although these values will be repeated at least every 65536 (216) packets.

Observing a very large number of forged packets may suggest that something is systematically wrong - for example, you may have started or ended the captures at different times (so that one machine has no record of having sent many of the packets that it did, in fact, send), you may have limited the number of bytes captured per packet at one end but not at the other end, you may have some kind of protocol offloading active on one end (so that one computer’s operating system is wrong about the contents of the packets that the network card actually sent over the wire).


ITREALMS Online ... delivering news for ICT4D Short URLs: goo.gl, mcaf.ee, cli.gs