Because many/most ISPs block simple outbound src addr spoofing. pwnat works b/c ISPs don't (currently) inspect deep enough to notice spoofed addresses in the e

Because many/most ISPs block simple outbound src addr spoofing. pwnat works b/c ISPs don't (currently) inspect deep enough to notice spoofed addresses in the error packet contained inside ICMP. This is an arms race b/t clever hackers and the ISP's increasingly deep packet inspection gear.