Silence on the Wire

The Consequences of Masquerading

All of the aforementioned scenarios are related to masquerading abuse, but the mere presence of masquerading itself can provide us with interesting information about another party.

As noted earlier, masquerading is not nonintrusive. Its basic operating principle is to alter the outgoing traffic by rewriting portions of it. In so doing, it goes beyond merely tweaking the address and not only makes it possible to conclude that masquerading is taking place, but also enables a careful observer to identify the particular firewall system in use. Specifically, when using masquerading, we may encounter some of the following changes:

• There will be an observed discrepancy between the TTL on arriving packets and the expected ...