Steps to observe packet spoofing by ISPs (12)

YOU might still have NAT or a firewall enabled at one end of the connection, or your ISP might be forging or altering packets routinely, perhaps with a technique like transparent HTTP proxying that is invisible to most application software.

It is important to think critically about the significance of evidence and whether results are reproducible or attributable to confounding factors. pcapdiff and the techniques described here are meant to help users find anomalous discrepancies between packets sent and packets received, not to definitively assign blame for the source of those anomalies.

Learning more about TCP/IP and interpreting network packet traces:

For a deeper understanding of network protocols and packet traces like those described here, you can consult the Internet standards documents that specify the TCP/IP protocol suite.

Most of these documents have been published in the RFC document series available at http://www.rfc-editor.org/ and http://www.faqs.org/rfcs/. For example, the Internet Protocol (IP) is described in RFC 791, the Transmission Control Protocol (TCP) in RFC 793, and the User Datagram Protocol (UDP) in RFC 768.

An excellent guide to the TCP/IP protocol suite in book form is W. Richard Stevens, TCP/IP Illustrated: Volume 1, The Protocols (Reading, MA: Addison-Wesley, 1994), ISBN 0201633469.


ITREALMS Online ... delivering news for ICT4D