I'm learning about UNIX and network programming. I'm not yet sure how to implement this. But I'm wondering:

If I forge IP packets of a TCP connection to a server, so that the SYN / ACK packets use one IP and the following packets use another IP, what should theoretically happen? Would the connection be dropped by the server?

I'm thinking that in the case of HTTP, one could change the IP after SYN / ACK and send one packet with "black hat" data to break the server without having to identify itself. Would such a thing work?


TCP/IP is a stateful protocol and keeps track of who initiated (IP address), port (both source and destination), sequence numbers etc. If your client doesn't follow the protocol, you'll not connect. That is, if you attempt to send packets to a server when you haven't established a connection (SYN, SYN+ACK, ACK) then your efforts will be silently ignored.

  • 1
    Unlikely to be silently ignored, more likely a TCP Reset (RST) is returned. As you say, TCP is a state machine. When traffic doesn't match the state of the state machine, the connection is reset so it can restart and try to achieve a good state. – suprjami Nov 17 '14 at 21:56

Yes, the packets will be dropped by the server because there is no open socket for the new source IP address.

Session hijacking is not possible without sniffing the current connection. When you look into an IP packet you will find an Identification flag and in the tcp header you will find sequence number and next sequence number. So you had to match these when hijacking to keep the session alive.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.