Monday, March 12, 2018

Mat Rix, Verification of Unspoofed Source Addresses


Fusebox at the Hotel Alchemy, image by Daniel Y. Harris




Verification of Unspoofed Source Addresses


1 2: 1 5: 1 8 . 9 1 3 1 8 4 IP ( t o s 0 x0 , t t l
3 6 , i d 2 0 3 3 5 , o f f s e t 0 , f l a g s [ none ],
p r o t o UDP ( 1 7 ) , l e n g t h 4 1 2 ) XX. 1 0.

1 0 0 . 9 0 . 1 8 7 8 > XX. 1 6 4 . 3 0 . 5 6 . 5 0 6
 0 : [ udp sum ok ] SIP , l e n g t h : 384 2 REGI
STER s i p : 3 9 8 2 5 1 6 0 6 8@XX. 1 6 4 . 3 0

. 5 6 S IP / 2 . 0 3 Via : S IP / 2 . 0 / UDP XX. 1
 6 4 . 3 0 . 5 6 : 5 0 6 0 ; b r a n c h =1 F8b5C6T
44G2CJt ; r p o r t 4 C o nt e nt−Le n gt h : 0 5

From : < s i p : 3 9 8 2 5 1 6 0 6 8@XX. 1 6 4.
3 0 . 5 6 > ; t a g =14718138184028634232183
42668 6 Acce pt : a p p l i c a t i o n / s d p 7 U

se r−Agent : A s t e r i s k PBX 8 To : < s i p : 3
9 8 2 5 1 6 0 6 8@XX. 1 6 4 . 3 0 . 5 6 > 9 C o n
5 6 10 CSeq : 1 REGISTER 11 C all−ID : 47310.


—Mat Rix