识别假UDP数据包
我想识别源 IP 地址是伪造的 UDP 或 TCP 数据包。我的猜测是，即使数据包是用 hping 等程序伪造的，所有伪造数据包的 MAC src 地址仍然相同，这是正确的吗？
如果我的想法不正确，我如何识别这些被伪造的数据包，并且看起来每个数据包都有不同的来源？
谢谢。
I want to identify an UDP or TCP packet that have its source IP address faked. My guess is that even if the packet is faked with a program such has hping, the MAC src address is still the same on all the faked packets, is this correct?
If my idea is not correct, how can I identify such packets that are being faked and looks like it has different source for each and every packet?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
MAC 地址也可以伪造。
使用 TCP，很容易识别/处理这个问题。您将使用 SYN-ACK 回复伪造的 SYN 数据包。如果是真实的客户端，它会回复 ACK 来完成握手。唯一需要注意的是，您必须实现 syn-cookie，这样您就不会创建状态和状态。等待 ACK 时会耗尽资源。
对于 UDP，没有办法知道，因为该协议是无连接的。如果您发送对假数据包的回复，则不能保证您会得到“真实”客户端的响应。所以没有办法辨别真假。
MAC addresses can be faked too.
With TCP, its easy to identify / handle this. You'll reply to a fake SYN packet with a SYN-ACK. If it was a real client, it'd reply with an ACK to complete the handshake. Only caveat is that you'll have to implement syn-cookies so that you don't create state & use up resources while waiting for an ACK.
With UDP, there is no way to know, since the protocol is connection-less. If you send a reply to the fake packet, you're not guaranteed a response from a "real" client. So there is no way to identify a fake one.
在我看来，UDP 和 TCP 与此无关。您谈论的只是第 2 层 (MAC) 和第 3 层 (IP)。即使这样，您也无法知道，因为源 MAC 地址应该是距离接收者最近的路由器的地址（假设数据包并非源自您的子网）。因此您应该看到大多数情况下的相同 MAC 地址入站数据包（同样，仅限互联网流量）。
现在有像 p0f 这样的分析工具可以处理数据包的签名，您可以尝试根据该信息进行一些启发式操作，但无法确定任何非常具体的信息。
The way I see it, UDP and TCP have nothing to do with this. You're talking about only layer 2 (MAC) and layer 3 (IP). Even at that though, you have no way of knowing, because the source MAC address should be that of the closest router to the recipient (assuming the packet did not originate in your subnet.) So you should see the same MAC address for most all inbound packets (again, internet traffic only).
Now there are profiling tools like p0f that work on signatures of packets, and you could try and do some heuristics based on that information, but nothing very concreted could be determined.
从数据包中您可以获取最近节点的 MAC 地址。是的，你可以向假源地址（IP）发送ACK数据包，然后使用Traceroute命令知道源数据包的路径，这样你至少可以找到起源的位置。它在 TCP 中运行良好，您也可以得到确认。
From the packet you can get the MAC address of the nearest node. Yeah you can send ACK packet to the fake source address(IP) and then use Traceroute command to know the path of the source packet, so that you can atleast find the location of the originating. It works well in TCP and you can have acknowledgement also.