# ping 192.168.1.116
What should be the outcome of this ping? In fact, we would get no reply for this ping. Because this IP address does not exist at all. So, the destination machine with the IP address 192.168.1.116 will receive the ping message and make an ARP query to find out what the hardware MAC address of this IP is. But the machine will not get any reply and won’t be able to respond to the pings. As a result, the source machine with the IP address 192.168.1.133 will get no reply at all.
Let’s do something different now. Let’s delete this iptables rule and execute some different commands.
# sudo iptables -t nat -D POSTROUTING -p icmp -j SNAT --to-source 192.168.1.121 # sudo iptables -t nat -A POSTROUTING -p icmp -j SNAT --to-source 192.168.1.138
So, we have deleted the previous rule from the machine with IP address 192.168.1.133 and added a new rule so that the source IP address of all outgoing ICMP packets is now 192.168.1.138. Please note that a machine does exist in the local network with IP address 192.168.1.138.
Now, I would execute the ping command in machine 192.168.1.133, where I have changed the iptables rules.
# ping 192.168.1.116
We will not get any response now either. Because we have pinged the machine 192.168.1.116 with a forged IP address. However, the machine does not know that the source IP address of the packets is forged. So, it will send replies to 192.168.1.138.
In fact, if I do the same steps from multiple machines and change the source IP address of all outgoing ICMP packets to 192.168.1.138 and ping different machines, all the machines will send replies to 192.168.1.138 and will eat up all its bandwidth and cause a Denial of Service or DoS attack for the machine 192.168.1.138. (What is Ping Flood ?)
How to detect IP spoofing?
Is it possible to know from the machine 192.168.1.116 that the ping messages it received were spoofed ones?
In fact, we can do that.
We would open Wireshark from a terminal.
# sudo wireshark
A window will appear like this :









































0 Comments