[c-nsp] something a little different rfc1918 from transitnetworks?

[Gert Doering]

Hi,

On Tue, Nov 13, 2007 at 10:29:28AM -0500, Eric Van Tol wrote:
> I think the question the OP is asking is, why would the same exact
> address be seen from two different peers, each 3 seconds apart?  

Equal-cost paths, load-balancing SYN and retransmit over two different
transit providers...

> With that said, the answers provided thus far are also correct.  There
> is really no way to tell whether they are spoofed or sourced from an
> actual address without tracking it down all the way to the source.

By definition the packet is spoofed, as nobody has the right to send out
packets with that source address to the Internet.

But that requires to look at the packet and the environment where it was
found - the packet without context could be anything.

(PS: please don't do full-quotes).

gert
-- 
USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             gert at greenie.muc.de
fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de