IPSpoofing

IP spoofing is the practice of constructing IP packets with a forged source address, so the packet appears to originate from a different host than the sender. It is used to obscure the sender’s identity, bypass IP-based access controls, or support denial-of-service and reflection attacks where responses are directed to a target.

How it works: An attacker sends packets with a spoofed source IP. For connectionless protocols such as UDP and ICMP, responses go to the spoofed address, not to the attacker. For TCP, completing a handshake with a forged address is more difficult, but spoofing can still enable blind or on-path attacks. Spoofing enables reflection attacks in which a large volume of small requests elicit a flood of responses to the victim, producing substantial disruption.

Impact: IP spoofing undermines security by enabling anonymity, traffic manipulation, and DoS. It can facilitate large-scale denial-of-service attacks via amplification through misconfigured services using UDP-based protocols, such as DNS, NTP, and SNMP. It also complicates access controls that rely solely on source addresses.

Defenses: Effective defenses emphasize filtering and authentication. Ingress and egress filtering (BCP 38/84) helps ensure packets use legitimate source addresses. Routers and firewalls can implement anti-spoofing measures, and cryptographic protection such as IPsec or TLS can eliminate reliance on source IP for authentication. Network monitoring and anomaly detection further mitigate spoofing risks.

Legality and ethics: IP spoofing is subject to legal and policy constraints and is often prohibited when used to disrupt services or evade security controls. It is sometimes used in legitimate network testing within controlled environments.