Probing the identification field of IP packets can also identify spoofing packets.
After receiving a suspicious packet, a host can send packets to the supposed
source to observe the identification field in its response. Different IP stacks may
set the identification field of IP packets differently. For instance, some hostsmay
choose a random identification number, and others may simply increment the
identification number for every packet. Assuming the source host simply increments
the identification field for every packet, the identification number in
the probe response should be near the identification number of the suspicious
packet; otherwise, the suspicious packet was a spoofing packet. Unfortunately,
if the source host sets the identification field in a more complicated manner,
it may be difficult or impossible to decide whether or not a suspicious packet
carries a spoofed source address.