Yes.
We're going to have an entire chapter dedicated to evading things like firewalls and other security
devices.
But we need to get into that a little bit right now.
You see, there is a common method of evading firewalls and IPS devices and IDS devices, and one of
those is IP spoofing.
And we need to talk about that in this context.
This is often the technique that will be used during reconnaissance phases.
So like I said, even though we're going to have a chapter dedicated to evading security devices, understand
that users or attackers, I should say, will often have a decoy IP address that they use, or they
will spoof an address so they will change their IP address, their source IP, so that it is one permitted
by your firewalls or other type of security devices.
This is a major problem.
And we'll talk about mitigations in a moment.
Now, understand that there's plenty of other ways they're going to try and get their reconnaissance
traffic around your security devices like fragmentation.
Source routing is a big no no.
Typically, this is where they can dictate which hops the packet is going to take, manipulating their
source port so that it looks like valid traffic customizing packets randomizing their host scan so it's
less often detected sending bad check sums.
These are all methodologies.
But the ability.
Proxy servers.
Yeah.
Proxy servers being used or anonymize was another type of proxy where the entire purpose of the proxy
is to disguise the identity of the individual.
So anonymous users here are big time utilized so that the people that are attacking us can stay anonymous
or try and stay anonymous.
So when it comes to IP spoofing countermeasures, we want to avoid trusting other network entities and
therefore having to allow their IP address space into our private networks.
We want to make sure firewalls and filters are tuned to only permit valid traffic in.
And here's the deal because IP spoofing is a reality because someone can show up with the what appears
to be correct IP address.
We cannot rely on IP based authentication alone.
Just think about the power of multi-factor authentication.
Would you ever want to say to some node, oh, I see you're at ten, ten, 10.100, so that's fine.
Come on in.
Now, we would never rely on the IP address as the only source of authentication.
We would make that individual prove something else as far as identity goes because of the common spoofing
of IP addresses.
Also, another great countermeasure is the randomization of initial sequence numbers, which is done
by most operating systems now just as a default built in security protection mechanism.
So yes, we might see spoofing and other tricks to try and make this reconnaissance possible or undetected.
We know there's going to be powerful countermeasures against such activities, thank goodness.