Re: Packet from port 80 with spoofed microsoft.com ip

On Wed, 29 Jan 2003 15:12:01 -0200, Thiago Conde =?ISO-8859-1?Q?Figueir=F3?= said:

> One should not trust reverse DNS for identification. The
> administrator for 249.46.207.in-addr.arpa could spoof that response.

Damned good spoof if so:

% dig 249.46.207.in-addr.arpa soa
249.46.207.in-addr.arpa. 751 IN SOA dns.cp.msft.net. msnhst.microsoft.com. 2003012903 7200 900 7200000 3600

;; AUTHORITY SECTION:

46.207.in-addr.arpa.    53126   IN      NS      DNS2.cp.msft.net.
46.207.in-addr.arpa.    53126   IN      NS      DNS1.TK.msft.net.
46.207.in-addr.arpa.    53126   IN      NS      DNS1.SJ.msft.net.
46.207.in-addr.arpa.    53126   IN      NS      DNS1.DC.msft.net.
46.207.in-addr.arpa.    53126   IN      NS      DNS1.cp.msft.net.

;; ADDITIONAL SECTION:
DNS2.cp.msft.net.       237     IN      A       207.46.138.21
DNS1.TK.msft.net.       114212  IN      A       207.46.245.230
DNS1.SJ.msft.net.       114212  IN      A       65.54.248.222
DNS1.DC.msft.net.       114212  IN      A       207.68.128.151
DNS1.cp.msft.net.       114212  IN      A       207.46.138.20

Which of course still doesn't prove that it wasn't a backscatter packet from a forged SYN, or a forged SYN+ACK...

-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek