2

My question was closed for being off topic. The reason stated by the moderator was that "This is not a security issue. This is pure TCP/IP".

I feel it is reasonable to consider my question in the security category, as the whole scenario is about protecting the network from outside attacks.

I even found there were technical names for this attack : IP-spoofing and blind session hijacking. This furthers the case in my mind for the question to be security related.

Can someone with more time than the moderator could kindly explain either 1) why I am mistaken and this question is "pure TCP/IP" or 2) what is the best course of action in my case to have my question reopened.

EDIT : my question was re-opened and immediately closed for a different reason : being a duplicate. So I guess that implicitly answers my question here : it was indeed on topic (since it was already asked and answered).

I would make the humble suggestion to have a different process when this happens.

The process :

  1. question closed for reason A
  2. discussion with the mod in which I argue that reason A is incorrect
  3. mod disagrees strongly, repeats his argument
  4. later, mod re-opens and closes the question for a different reason (I am guessing - but not sure - that the same mod did this)

could be perceived from the asker as coming from an unreasonable desire to close that question from the mod, who did not like being challenged. I am sure that's not what happened here, but a humble suggestion for improvement would be that the mod acknowledges his mistake/provides an explanation before re-opening and closing for a different reason. This could be perceived for doggedness (I hope that's the right word), and I know we all want to avoid that perception, and make all stack exchange sites friendly places for everyone to interact.

EDIT 2 : After careful review of the links for duplicate, I realize the reason “being a duplicate” is also incorrect. In my question I am suggesting that only 1 tcp or udp packet from the attacker is seen, received and processed by the computer in the network. Not that the response from the computer is received by the attacker. You can do some damage with only 1 packet if you are being crafty. The 4 other questions ask whether a connection can be established, or whether the response can be sent to the attacker.

1 Answer 1

Reset to default
2

Nope, it's not IP spoofing. IP spoofing is just one part of your imagined scenario.

And it isn't blind session hijacking either, since your scenario is not a man-in-the-middle. If you were in the middle, the scenario would be very different.

You are asking about pure TCP/IP concepts. There isn't a "feature on the firewall" to protect. This is just how TCP/IP was designed.

8
  • 1
    Thanks for your answer. You acknowledge that IP spoofing is part of my scenario. But then you say my question is "Pure TCP/IP". In my mind this is contradictory since IP spoofing is a security issue.
    – DevShark
    Feb 16, 2021 at 10:03
  • You're reaching and stretching your logic. Your question is about how such a scenario is prevented. Just because your scenario has an attacker or has ip spoofing doesn't make the question about security. I can't ask a question about dog training because I want to train the dog to walk around the neighbourhood in a certain pattern carrying a wifi jammer (the scenario has an attacker and wifi jamming).
    – schroeder Mod
    Feb 16, 2021 at 10:06
  • 1
    You are asking how such a situation is prevented. Not how to attack it, not what the weakensses are. The answer is found in how TCP/IP works. I have pointed you, twice, to basic TCP/IP concepts. Please review these and then come back to refine your question if necessary.
    – schroeder Mod
    Feb 16, 2021 at 10:07
  • 1
    "You're reaching and stretching your logic". Your point about dog walking is what is reaching and stretching. Need an argument? Very few books about Information security will talk about dog walking. Many will talk about IP spoofing. Your other argument about me talking about "preventing" rather than "attacking" is also very weak. These are the two sides of the same coin. I have reviewed the concepts that you pointed out and still believe there is a point to be made. But clearly you are not open to this. It is disappointing, but you're the mod. Your rules.
    – DevShark
    Feb 16, 2021 at 11:14
  • The question, if I understand it correctly, is essentially asking if this technique would be able to bypass firewall restrictions blocking incoming packets, and if not, what would prevent it. It might just be my lack of knowledge, but I fail to see how it is pure TCP/IP (AFAIK the TCP or IP rfcs doesn't contain specifications for firewalls).
    – nobody
    Feb 16, 2021 at 13:21
  • As I said, the question is not about IP spoofing. You literally ask "What security measure in common routers/firewall prevent that?" Your answer is found in the basics of TCP/IP. Please, just review the basics of sockets, streams, and stateful firewalls.
    – schroeder Mod
    Feb 16, 2021 at 15:11
  • 1
    I see my question was re-opened and then closed again for a different reason : it being a duplicate. I am not arguing against this being a duplicate, I am deferring to more knowledgeable people. The whole process is strange though. I would suggest that if you have made a mistake (marking it incorrectly as off-topic), maybe acknowledge the issue before re-opening it and closing it again for a different reason. Because from the perspective of the asker, this could feel like an unreasonable motivation on the mod part to close that question. I am sure it's not, but it could be handled better.
    – DevShark
    Feb 16, 2021 at 19:34
  • I just did what I've been asking you to do: to look up the concepts. I clicked on the "ip spoofing" tag and found other questions that were tangential to yours. I then linked your question to those ones. As you can see, each answer discusses the basic concepts of TCP/IP. Your suggestion that it was on-topic is false. I just did your work for you.
    – schroeder Mod
    Feb 16, 2021 at 21:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .