When a site has more than a dozen non-contiguous Class C networks in internal use, routers are often configured with several hundred filters per port . Thus, you have to trust everyone on the system. If the trusted host is cracked, the cracker can get through your packet filter. Routers which do not provide for strong user authentication should never allow users into protected systems. During the past year Trojan Horses that sniffed user IDs and passwords on the Internet compromised more than 100,000 user IDs and static passwords.
Routers are subject to various attacks that divert packets through crackers machines.
Crackers can mimic the IP addresses of trusted machines, by-passing packet filters and gaining access to systems. Kevin Mitnick blindly sent command packets bearing trusted internal IP address into networks until the router allowed him access. Some routers do not provide logs of systems, user activity or records of successful and unsuccessful attempts to use the system. Logging is a fundamental component of Level C2 security and above. Packet filters can leak sensitive information in IP packet fragments.