Detecting packet injection: a guide to observing packet spoofing by ISPs