2 ms·

I have used IP spoofing for good in the past: I had a large number of sensors reporting real time data to our servers. As we wanted to migrate to a completely n

I have used IP spoofing for good in the past: I had a large number of sensors reporting real time data to our servers. As we wanted to migrate to a completely new infrastructure we wanted to have replication from the old servers to the new. Instead of setting up some kind of higher level system, I wrote a tiny service in C which received the datagrams and then re-sent them to the new servers but spoofed the source IP so it matched the sensor. This worked incredibly well, and the tool was later used for various other purposes. Of course toward the end of it I learned that I could have done this all with iptables, but I like my way better because I got to learn a lot.

hueving 10y ago
Ugh, if you're identifying sensors by IP instead of some other ID in the payload, you're doing it wrong. NAT between the sensors and you can throw a wrench into that whole scheme in a hurry. This is just a smell emanating from another poor design, not a justification for IP spoofing. If you want to spoof addresses, do it in the privacy of your own VPN tunnel between the servers. Don't expose that sickness to the Internet.
- IgorPartola 10y ago
  You sir are quick to jump to very incorrect conclusions. It's a bad habit and you should abandon it at once. First, I never said we identified the sensors by IP, but it was important that we record the sensor's IP for diagnostic information. Second, IP spoofing was not done over the Internet, but rather only between our own servers inside our data center. Obviously doing this over the internet would not only be bad, but also highly unreliable. In conclusion... well I'm trying to be polite.
  - hueving 10y ago
    If you have anything, including diagnostic information, that depends on the source IP being correct, you're doing it wrong.
    - colejohnson66 10y ago
      Port forwarding on some consumer grade routers work using IP addresses (not MAC addresses). If I assign a computer a static 192.168/16 IP and forward a port to it, I'm doing it wrong?
spc476 10y ago
There are valid reasons to spoof IP addresses (we do that at work in production). It's only bad if the spoofing "leaks" out to the Internet at large (at work, we know which machines are doing the spoofing, and it's a limited number of spoofed addresses, all directed towards own own equipment).

hueving 10y ago

Ugh, if you're identifying sensors by IP instead of some other ID in the payload, you're doing it wrong. NAT between the sensors and you can throw a wrench into that whole scheme in a hurry. This is just a smell emanating from another poor design, not a justification for IP spoofing. If you want to spoof addresses, do it in the privacy of your own VPN tunnel between the servers. Don't expose that sickness to the Internet.

IgorPartola 10y ago
You sir are quick to jump to very incorrect conclusions. It's a bad habit and you should abandon it at once. First, I never said we identified the sensors by IP, but it was important that we record the sensor's IP for diagnostic information. Second, IP spoofing was not done over the Internet, but rather only between our own servers inside our data center. Obviously doing this over the internet would not only be bad, but also highly unreliable. In conclusion... well I'm trying to be polite.
- hueving 10y ago
  If you have anything, including diagnostic information, that depends on the source IP being correct, you're doing it wrong.
  - colejohnson66 10y ago
    Port forwarding on some consumer grade routers work using IP addresses (not MAC addresses). If I assign a computer a static 192.168/16 IP and forward a port to it, I'm doing it wrong?

spc476 10y ago

There are valid reasons to spoof IP addresses (we do that at work in production). It's only bad if the spoofing "leaks" out to the Internet at large (at work, we know which machines are doing the spoofing, and it's a limited number of spoofed addresses, all directed towards own own equipment).