detect a fake ip address

[Izi]

Hi,

Does anyone know of a way to detect a fake IP address connecting to a server through HTTP?

We keep trying to be Blind SQL injected every few minuets from apparently different IP addresses.

Does any one have an solutions on this?

here is a typical attempt:

DECLARE @T VARCHAR(255),@C VARCHAR(255) DECLARE Table_Cursor CURSOR FOR SELECT a.name,b.name FROM sysobjects a,syscolumns b WHERE a.id=b.id AND a.xtype='u' AND (b.xtype=99 OR b.xtype=35 OR b.xtype=231 OR b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN EXEC('UPDATE ['+@T+'] SET ['+@C+']=RTRIM(CONVERT(VARCHAR(4000),['+@C+']))+''''') FETCH NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor

 

[GarethDW]

Yes, you can do this. Depending on the size of your network, this may be overkill, however.

Briefly, you blackhole traffic based on source address, and use unicast reverse path forwarding to determine if the IP has been spoofed. Using "loose" URPF, you can check to see if there is an entry in the Forwarding Information Base (FIB), if there is then the packets get forwarded to the intended destination, whereas others get routed to null0.