Source address-fabricated packet detection unit, source address-fabricated packet detection method, and source address-fabricated packet detection program

摘要

A source address-fabricated packet detection unit that detects a packet with a fabricated source IP address comprises a packet controller that controls the input/output of a packet and acquires a source IP address and TTL value of the input packet; a reference TTL value storage section that stores a reference TTL value that represents a normal time to live range and source address in a correspondence manner; and an address fabrication determination section that compares the TTL value of the input packet and reference TTL value corresponding to the source IP address of the input packet to determine the presence or absence of the fabrication of the source IP address in the input packet based on the comparison result.