Re: Redir games with ARP and ICMP

John McDonald (jmcdonal@OSPREY.UNF.EDU)
Fri, 24 Oct 1997 17:37:05 -0400

I was playing around with the ICMP-redirect spoofing code from Yuri Volobuev and I've noticed some behaviors of IP stacks that seem to limit it's effectiveness at spoofing on a LAN. I tried it on 3 digital unix 4 boxes, 2 Solaris 2.5 boxes, and an HPUX bo
x, and got similair results on all of them..

Quoting from W. Stevens TCP/IP Illustrated, Volume 1 page 123:
...
Additionally, a 4.4BSD host that recieves an ICMP redirect performs some checks before modifying its routing table. These are to prevent a misbehaving router or host, or a malicious user, from incorrectly, modifying a system's routing table.

1. The new router must be on a directly connected network.
2. The redirect must be from the current router for that destination.
3. The redirect cannot tell the host to use itself as the router.
4. The route that's being modified must be an indirect route.
...

So, basically, if you have two machines on the same subnet and they both have a net route for that subnet, then you can't use ICMP to re-route one to another. At least this is true for the boxes I've tried it on..

You can still use redirects to forward traffic destined for hosts that are on a different subnet or outside of the network.

humble - jmcdonal@unf.edu