[TriLUG] Detecting and Resolving Spoofed IPs

[Jeff Bollinger]

Does anyone know of a fool proof way to determine the real IP address of 
a system spoofing with one or two spoofed IPs?  For example, you see two 
IPs coming across your border router hitting the same host in your LAN 
and with the same TCP sequence numbers.  Is it ever possible to 
determine the true source IP after it has crossed the ingress on the router?

Thanks,
Jeff


-- 
Jeff Bollinger
University of North Carolina
IT Security Analyst
105 Abernethy Hall
mailto: jeff_bollinger at unc dot edu