This is example of flowing of good packets and observation of them with tcpdump, just to remind when person is using spoofed ip headers then connection wont exchange all these flags with packets, it stay with flag `S` and response `S.` nothing else. So here we can see if connection is spoofed or not and like this we can use proxy that check and create lag for short,super short time and on X connection and if next packet dont arrive then you know it is spoofed and they are bad guys!
Example of flow of good packets:
15:25:17.518740 IP 192.168.1.101.53204 > 192.168.0.69.80: Flags [S], seq 1949789886, win 64240, options [mss 1460,sackOK,TS val 2631633487 ecr 0,nop,wscale 7], length 0
15:25:17.620369 IP 192.168.0.69.80 > 192.168.1.101.53204: Flags [S.], seq 975389135, ack 1949789887, win 65160, options [mss 1460,sackOK,TS val 943638276 ecr 2631633487,nop,wscale 10], length 0
15:25:17.620586 IP 192.168.1.101.53204 > 192.168.0.69.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 2631633589 ecr 943638276], length 0
15:25:19.258536 IP 192.168.1.101.53204 > 192.168.0.69.80: Flags [P.], seq 1:6, ack 1, win 502, options [nop,nop,TS val 2631635227 ecr 943638276], length 5: HTTP: GET
15:25:19.364963 IP 192.168.0.69.80 > 192.168.1.101.53204: Flags [.], ack 6, win 64, options [nop,nop,TS val 943640020 ecr 2631635227], length 0
15:25:19.364965 IP 192.168.0.69.80 > 192.168.1.101.53204: Flags [P.], seq 1:310, ack 6, win 64, options [nop,nop,TS val 943640021 ecr 2631635227], length 309: HTTP: HTTP/1.1 400 Bad Request
15:25:19.364967 IP 192.168.0.69.80 > 192.168.1.101.53204: Flags [F.], seq 310, ack 6, win 64, options [nop,nop,TS val 943640021 ecr 2631635227], length 0
15:25:19.365364 IP 192.168.1.101.53204 > 192.168.0.69.80: Flags [.], ack 310, win 501, options [nop,nop,TS val 2631635334 ecr 943640021], length 0
15:25:19.405970 IP 192.168.1.101.53204 > 192.168.0.69.80: Flags [.], ack 311, win 501, options [nop,nop,TS val 2631635375 ecr 943640021], length 0 ..
15:25:19.421302 IP 192.168.1.101.53204 > 192.168.0.69.80: Flags [P.], seq 6:7, ack 311, win 501, options [nop,nop,TS val 2631635390 ecr 943640021], length 1: HTTP
15:25:19.465478 IP 192.168.0.69.80 > 192.168.1.101.53204: Flags [.], ack 7, win 64, options [nop,nop,TS val 943640121 ecr 2631635390], length 0
15:25:19.582820 IP 192.168.1.101.53204 > 192.168.0.69.80: Flags [P.], seq 7:8, ack 311, win 501, options [nop,nop,TS val 2631635551 ecr 943640121], length 1: HTTP
15:25:19.587095 IP 192.168.0.69.80 > 192.168.1.101.53204: Flags [.], ack 8, win 64, options [nop,nop,TS val 943640242 ecr 2631635551], length 0
15:25:20.342471 IP 192.168.1.101.53204 > 192.168.0.69.80: Flags [F.], seq 8, ack 311, win 501, options [nop,nop,TS val 2631636311 ecr 943640242], length 0
15:25:20.386777 IP 192.168.0.69.80 > 192.168.1.101.53204: Flags [.], ack 9, win 64, options [nop,nop,TS val 943641041 ecr 2631636311], length 0Bad packets send only [S] and nothing else. Or second attack can be that send [S] and [R]... But.. you can see, nothing special. Script kiddies!
Well this are old guys that act like children. Bad!