From owner-freebsd-net@FreeBSD.ORG Thu Feb 17 11:53:17 2005 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B189516A4CE for ; Thu, 17 Feb 2005 11:53:17 +0000 (GMT) Received: from cyrus.watson.org (cyrus.watson.org [204.156.12.53]) by mx1.FreeBSD.org (Postfix) with ESMTP id 796D243D3F for ; Thu, 17 Feb 2005 11:53:17 +0000 (GMT) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by cyrus.watson.org (Postfix) with SMTP id 3034B46B39; Thu, 17 Feb 2005 06:53:17 -0500 (EST) Date: Thu, 17 Feb 2005 11:51:52 +0000 (GMT) From: Robert Watson X-Sender: robert@fledge.watson.org To: Andrew Heyn In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: freebsd-net@freebsd.org Subject: Re: paranoia X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Feb 2005 11:53:17 -0000 On Wed, 16 Feb 2005, Andrew Heyn wrote: > Here's an on/off topic question i've been wondering about forever... > > I always see people replace their IPs with fake replacements. Is this > paranoia really warranted? Why not disconnect the cat5 if you want to > do this? > > Or am I not seeing things the right way? People who "fake" IPs generally do so for purposes of anonymity or to prevent revealing information about their network infrastructure. Here are a few examples of situations where people look to conceal their IP addresses - Firewalls and NATs perform address translation to conceal the internal layout of a network. This can make it substantially harder to effectively attack a network. - Spammers attempt to conceal their IP addresses so that they cannot be tracked back to a particular ISP. - Attackers using distributed denial of service attacks will conceal their IP addresses so they cannot be traced back to a particular end-host. - End-users seeking to send anonymous tips, etc, i.e., to the police, media, or others, will conceal their IP addresses to hide their identities. So there's quite a spectrum of interest in the topic :-). Sometimes this is done by spoofing IP addresses using raw sockes or BPF; other times, it is done through proxies, onion routing, and so on, which requires collaboration by other parties (witting or otherwise). Robert N M Watson