[Ethereal-users] Spoofed packets...

[Nathan Boettcher <swighost@xxxxxxxx>]

I apologize for this question since it isn't exactly about the program but
I am not sure where to turn and the documentation I have been able to grab
hasn't helped me very much.  I wanted to know how packets are set up?  I
ask this because I realized if someone is scanning a machine using spoofing
you get the wrong address(of course that's the point) so you can't use it
as a reliable ip for traceroute.  But the originating ip must be listed
somewhere in the syn packet so a reply can be sent to the originating
machine right?  How does one go about pulling that ip out of the packet? 
This might be an added feature for Ethereal if it isn't already there. 
Thanks in advance and sorry for the semi-off topic email.

-Nathan

-- 
Nathan Boettcher
swighost@xxxxxxxx

"Windows: A 32-bit patch to a 16-bit graphical interface based on an 8-bit
operating system origionally encoded for a 4-bit processor written by a
2-bit company that can't stand 1-bit of competition."