Re: pf protection against spoofed [source addr] packets

On Wed, Oct 20, 2010 at 04:50:49AM +0300, Nerius Landys wrote:
> >I then tried to use nemesis to change the spoofed source address from
> >64.156.193.115 to 127.0.0.1 or 192.168.0.x, but nemesis wasn't able to
> >do this with the error message "ERROR: Incomplete packet injection.  Only
> >wrote -1 bytes."
> 
> Sorry my mistake.  I _was_ able to spoof a source address such as
> 192.168.0.1, but _not_ 127.0.0.1.  Wondering why; I'd like to see
> how my service reacts when I send a UDP packet with a spoofed source
> address of 127.0.0.1, but don't know how to do it.

At least on OpenBSD the network stack has logic that never allows
127.0.0.1 to appear on the wire and IIRC they are not accepted as well.
You need to use bpf(4) to inject such packets.

-- 
:wq Claudio