Hacker News new | ask | show | jobs
by prvit 1396 days ago
This is a very old and oft-repeated trick though.

https://github.com/blechschmidt/fakeroute

https://github.com/antifork/hopfake

https://github.com/jprenken/rickroute

https://github.com/sams-gleb/ipv4-traceroute-fake

https://github.com/job/ipv6-traceroute-faker

And so on…

I remember being a 13yo kid sitting on IRC doing exactly this for fun years ago back when IP addresses were cheap and easy to come by. But spoofing military IPs in the traceroute was more fun.

4 comments

Believe it or not, you might have very specific interests :)
If a 13 year old was using irc regularly in 2022 I would be concerned for them. Not thata 13 year old shouldn't use irc but I would wonder how they found that destination, especially given the countless other sinks for internet denizens
Free software development and chat still largely happens over IRC: witness irc.gnome.org and libera chat.

As a 13 year old, if I had access to internet instead of buying Slackware floppies from local software "pirates" (they also had all the DOS stuff like Wordperfect and games), I'd probably be hanging around IRC.

I don't think there was much to be concerned about me back then.

I'm curious why you would be concerned. I've seen a good number of teenagers hanging around and playing with computers.
How would you spoof arbitrary IPs? IIUC it's poked at as the next hop...?

(Mhm, embarrassingly out of the loop)

I _think_ that if you know the real source and real destination of an ICMP message, you can just forge back a message with an arbitrary TTL exceeded message, from any "I'm IP address xxx" address. Those can come from a lot of rando IPs because the intent of them is just "at this hop, the TTL ran out", and the hops the original sender wouldn't know anyway. A lot of fake hops would be essentially impossible if you examined the real BGP routes and stuff, but verifying that in real time sounds hard enough that I bet nobody bothers.

I'd have to do a lot more research and testing to verify though, not something I've played with in practice, and obviously my terminology isn't even right above, so take it for what it's worth.

If you return fake IPs in a traceroute you won't be able to control the reverse DNS which is the point of this exercise.
You can however control the IPs, so you can pick IPs with funny nsa.gov/.mil/fbi rdns (and matching forward records).
I understood this current thread to be another, separate, stupid ICMP trick. I wouldn't think the two tricks can be combined.
Fakeroute was the funniest thing in the world back then. Thank you.
Thanks for sharing these links.