如何通过PCAP文件判断地址伪造及检测hPing伪造内部地址的方法

Alright, let's tackle these network forensics and detection questions—super relevant stuff for maintaining network integrity!

Here are actionable ways to spot address spoofing in a PCAP capture:

• Verify IP-MAC mapping consistency：In a normal internal network, each IP should tie to a consistent MAC address (unless DHCP renews it). If you see a single IP associated with multiple distinct MACs, or a MAC linked to IPs outside its assigned subnet, that's a red flag. Use a command like tshark -r your.pcap -T fields -e ip.src -e eth.src | sort | uniq -c to tally up mappings and spot anomalies.
• Check TTL value plausibility：Different OSes have default TTL values (Windows typically uses 128, Linux/Unix uses 64). If a packet claims to come from a Windows machine but has a TTL of 63 (which would mean it hopped once from an initial 64), that's suspicious. Run tshark -r your.pcap -T fields -e ip.src -e ip.ttl to cross-reference TTLs with expected OS defaults.
• Analyze TCP sequence/window behavior：Spoofed packets often break normal TCP session logic. Look for random SYN packets with no corresponding ACK, or sequence numbers that don't align with an ongoing session—these are dead giveaways in a PCAP.
• Compare reverse traffic flow：A spoofed source IP can't receive response packets, so you'll see outgoing requests from the spoofed IP with no matching incoming traffic. If a PCAP shows one-way traffic from an IP that should have bidirectional communication (like a client accessing a server), spoofing is likely.

First, let's cover the classic signs of hPing-generated spoofed traffic:

• Unusual packet flag combinations：hPing lets users craft custom TCP/UDP/ICMP packets, like TCP packets with SYN+FIN flags set, or packets with no flags at all—these are extremely rare in legitimate traffic.
• Uniform packet rate：hPing's default packet generation is often highly regular (e.g., a fixed number of packets per second), whereas normal user traffic has variable, bursty patterns.
• Mismatched IP-MAC pairs：As you noted, if an internal IP is paired with a MAC that's not in your DHCP/ARP records, that's a clear indicator.

Now, beyond MAC-based detection, here are other methods to catch hPing spoofing:

• Signature-based IDS/IPS rules：Create or use pre-built rules to match hPing's unique traits. For example, a rule targeting TCP packets with flags 0x03 (SYN+FIN) or unusually large ICMP payloads can trigger alerts. Tools like Suricata or Snort make this straightforward.
• Session integrity checks：Spoofed source IPs can't complete a TCP three-way handshake—responses go to the real IP owner, not the attacker. So look for clusters of unacknowledged SYN packets from a single IP in your PCAP or real-time traffic.
• NetFlow/sFlow traffic analysis：Track traffic patterns for internal IPs. If an IP suddenly starts sending massive amounts of ICMP echo requests or traffic to non-standard ports (when it never did before), that's a sign of hPing activity.
• Real-time ARP monitoring：Use tools like arpwatch to track ARP table changes. If an internal IP is suddenly advertised by a new, unknown MAC address, it's likely a spoofed hPing attack.
• IPID pattern analysis：hPing generates packets with sequentially increasing IP identifiers (IPID), while most legitimate OSes use random or semi-random IPIDs. Run tshark -r your.pcap -T fields -e ip.src -e ip.id to check for overly consistent IPID sequences from a single source.

内容的提问来源于stack exchange，提问作者KingJohnno