How do you detect if the IP address for data received via a web form has come from a spoofed IP address?
If detection is possible in PHP, is there a library that will also attempt to find the real IP address?
+2
A:
Äh - you can not. There can not be a spoofed IP address.
See, HTTP (which is the b asis for web forms) runs on top of TCP.
If I spoofe my IP address in the TCP process, I will never manage to establish the TCP connection. WIthout an established TCP connection, I can not send any data to your server.
THe connection on your side keeps stuck in a half open state - which, btw., was one of the attack vectors some time ago for a denial of service attack (overloading servers with half open connections so real ones do not get established):
Ergo: In order to complete the form data submission, I need to open the TCP channel, for which my IP packets need to provide the real IP address.
Where did you get the idea that your submissions come from spoofed IP addresses?
TomTom
2010-04-14 17:51:31
If the site isn't using syncookies and is using predictable initial sequence numbers, it's possible to create a live TCP connection without actually using your correct IP address (since you don't need to see the replies). Of course, the fix in this case is to have the site use syncookies or at least unpredictable initial sequence numbers.
Jon Bright
2010-04-14 17:55:23
If a given IP address is used to submit the same form many times, that IP can be banned from future submissions? And there's no way someone can abuse that to ban somebody else's IP address? (My worry is that the autoban could be spoofed to prevent other people from using the form.)
Dave Jarvis
2010-04-14 18:41:23
IP addresses obviously aren't assigned per person so I don't see how this would work. If you ban an IP then the IP could be reassigned to a different computer resulting in a) the original computer regaining access and b) the new computer being banned.In addition, plenty of IP addresses will be shared by many, many users. For example, if you ban a proxy IP address, you will ban everybody on that proxy, not just the abuser.IP filtering works great for stuff like MegaVideo where the ban is time sensitive (72 minutes) but you can't permanently get rid of abuse in this way, I don't think.
Rupert
2010-04-14 20:30:36
Thanks for the ideas, Rupert.
Dave Jarvis
2010-04-14 21:38:06