Steps to observe packet spoofing by ISPs (9)

As a technical matter, any of these ISPs has the ability to spoof (or drop) packets.
Detecting the presence of spoofed packets, then, does not directly reveal or conclusively establish which ISP was responsible for injecting them.

To find out which ISPs were involved in the process of forwarding packets from one computer to another, one can use the trace route tool or any of its descendants or variants. (On Unix and MacOS, the command-line version of this tool is generally called trace route; on Windows, it is known as tracert.)

This tool is run with a host name or IP address as its argument and experimentally determines the path probably followed by probe packets, displaying a list of the routers in between the local computer and target computer.

In order to establish which ISP is responsible for packet spoofing, one could try experiments with a wide variety of ISPs in order to determine if users of one ISP routinely or disproportionately experience that sort of spoofing; one could also try to enable a virtual private network (VPN) to hide traffic from a local ISP, although the details of this process are beyond the scope of this document.

Using pcap files:
As we’ve described above, packet capture files produced by Wireshark and many other network analyzer programs are normally in the pcap format (also known as libpcap format or tcpdump format). This format is an open standard that is widely understood by network analysis software.

ITREALMS Online ... delivering news for ICT4D