
Click on the interface you want to listen to. In my case, it is eth1. And then, click on any ICMP message coming from 192.168.1.138. Now, if we click on Ethernet II of that ICMP message, we see that the source MAC address is 00:1f:3a:bc:7b:58.
But from the ‘arp-scan’ output, we saw that the machine with IP address 192.168.1.133 has a MAC address cf:4b:63:7f:04:84, which is an anomaly. You can confirm the same with tcpdump also.
So, if the attacker forges the source IP address of his packets to contain the IP address of some machine within the victim’s local network, then the victim can verify and find that out. But if it is not within the local network, then it is very difficult to find that out. Configuring a strong firewall is always a good option.
How to prevent IP spoofing?
By configuring proper firewalls, we can prevent spoofed IP packets. We can always set a firewall rule that will reject or ignore all packets that come from outside the local network but have IP addresses inside the local network.









































0 Comments