["John F. Regus" <jfregus@xxxxxxxxxxxxx>]

I am getting bombed with malware from certain sites that I can trace back to a spoofed IP address that hijacks a legitimate IP address from the first hop the intruder hits.

The intruders address always shows up as ??? ??? ??? ???.  

However, if I can see the traffic going into the hop and time correlate it to what was coming in att the same time and what went out milliseconds later, then I might be able to capture the real IP address and turn it over to CERT/FBI.

 

Is there a way to do this with Ethereal?

 

Thanks,

John Regus