Is it possible to change the source address of any TCP packet ? I am aware of the fact that I will not receive those packets if I change the address, I only need to place a request on the server. How is this possible ?
2
-
1Yes you can do it but we need to know why, this site if for professional sysadmins, and it sounds like you might be trying to get around something rather than fix something at source.– Chopper3May 29, 2013 at 7:11
-
A simple solution would be an iptables SNAT rule. You will not be able to completely a request though. Since you won't be able to complete the TCP handshake.– ZoredacheMay 29, 2013 at 7:21
Add a comment
|
1 Answer
You can change the source address of any IP packet. That is called "spoofing".
However, for TCP, that will not help you: TCP isn't a datagram-oriented protocol but a stream-oriented one. In practive, that means it's designed to simulate a stream-oriented communication channel using discreet packets transparently. In order to do that, it will reassemble packets together to form a stream but also has built-in mechanism to recoved from packet loss and incorrect packet arrival. It also has mechanism to handle connection status management.
All that means that, before you can send "a request" to a TCP server, you much first establish and that will require the client and server to perform a 3-way handshake: a negotiation between the client and server that ensure that both end of the connection agrees to open the connection. During that negotiation, both client and server will pick a random sequence number that must be used by the other peer.
This number is then increased by one for every packet sent by one end of the connection and used to check whether packets have been dropped or received in the incorrect order.
Since you will not get the answer to your first SYN packet (the first packet in a TCP handshake) and since you need to know the sequence number that is contained in that reply before you can finalize the connection and start sending data, you can't just spoof the source IP in a TCP connection.
Now, if you're somewhere on the path between the server and the spoofed client, you could stiff out the answer (even if it's not meant to you), finalize the connection by using the proper sequence number and send your request (you can even read the answer. This, however, will require you to be connected to one of the segment between the client and the spoofed server AND be able to read these packets as they go through the segment. This condition is quite difficult to achieve in practice outside of the final segment and even then you need to use either special hardware (a switch that can use a port as a "monitoring" port) or use ARP poisoning on the switch. It's not really trivial and will still allow you only to spoof a machine on your local segment.
