A project that communicates with clients behind NAT while making it difficult to directly identify the actual server, using ICMP Echo Reflection and ICMP Destination Unreachable.
- Leverages the property that data included in an ICMP Echo Request is returned as-is in the Echo Reply. Uses a third-party server as a reflector to relay data indirectly.
- To circumvent restrictions imposed by IP spoofing prevention policies such as BCP 38, ICMP Echo Request packets are encapsulated within IPIP packets before transmission.
- This method is used only when the NAT does not rewrite the ICMP Echo Request ID.
- Leverages the property (RFC 5508) that ICMP Destination Unreachable packets can be delivered in association with an existing NAT session based on the information of the original packet contained within them.
- This method is used when the NAT rewrites the ICMP Echo Request ID.
The actual server's IP is used alongside the IPs of multiple third-party servers. As a result, it is difficult to distinguish the actual server by observing only the client's network traffic.
When the NAT does not rewrite the ICMP Identifier, ICMP Echo Reflection is used.
In this case, the actual data is delivered indirectly through ICMP Echo Replies generated by a third-party server, making it difficult to directly identify the actual server's IP from the source IP of packets received by the client.
When the NAT rewrites the ICMP Identifier, the ICMP Destination Unreachable method is used.
In this case, analyzing the server IP of the ICMP Echo Request referenced within the ICMP Destination Unreachable packet may allow one to estimate candidates for the actual server.
However, when analyzing only network traffic without prior knowledge of the server-side code or protocol structure, it remains difficult to identify the actual server.
{
"servers": ["8.8.8.8", "1.1.1.1", "127.0.0.1"],
"server_addr": "127.0.0.1",
"relay_addr": "127.0.0.1",
"admin_key": "hajoon22",
"web_listen": "127.0.0.1:8080"
}- servers: Specifies the IP addresses of the ICMP servers configured in- client/config.h.
- server_addr: Specifies the IP address of the actual server. Used to prevent the server's own address from being selected as a reflection target for ICMP Echo Reflection.
- relay_addr: Specifies the IP address of the relay device that receives IPIP packets and routes the inner packets to the external network. Devices vulnerable to CVE-2020-10136 may also serve as such a relay.
- admin_key: The administrator API key used for authentication in the admin web API.
- web_listen: Specifies the address to which the admin web server binds to receive requests.