IP Spoofing - Forging Source Addresses in Packets

About 2 min read

IP spoofing is an attack technique that falsifies the source address of IP packets to hide the attacker's identity or impersonate a trusted host. It is widely used to amplify DDoS attacks and to bypass IP-address-based authentication. The design of the TCP/IP protocol does not mandate verification of the source address, which is what makes this attack possible. As of 2025, the adoption rate of BCP38 still cannot be called sufficient, and DDoS amplification attacks that exploit IP spoofing remain a major threat.

What Happens to the Party Whose Address Is Spoofed

A distinctive aspect of attacks that use IP spoofing is that, for the organization whose address is spoofed, the damage appears as a flood of responses to queries it never sent. When an attacker sends queries with the source spoofed as the target's address to legitimate servers, the responses arrive at the target, which sent none of those queries. From the target's point of view, the other end of the communication consists of legitimately operated servers, and no trace of the attacker remains anywhere in the traffic, so tracing the source does not lead to the attacker. Moreover, because the responses come from many legitimate servers, blocking any particular source is not enough to handle the situation. Even if an organization's own systems have not been compromised at all, it can be pushed onto the receiving end simply because its address was used for spoofing — which is why countermeasures against this attack cannot be completed by one organization's efforts alone and are treated as a network-wide challenge.

How IP Spoofing Works

The attacker rewrites the source address field in the IP packet header to an arbitrary value before sending it. UDP-based communication is connectionless, making spoofing easy, and it is abused in DNS reflection attacks and NTP amplification attacks. In TCP-based communication, a three-way handshake is required, so complete spoofing is difficult; however, it is effective for attacks that do not complete a connection, such as SYN flood attacks.

Actual Attack Scenarios

In a DDoS attack, DNS queries with the source IP spoofed as the target's address are sent to a large number of DNS servers. The responses from the DNS servers converge on the spoofed target address, saturating the target's network. In this amplification attack, a small query elicits a response dozens of times larger, allowing the attacker to generate more traffic than their own bandwidth. There is also a technique in which, as a preliminary stage to a man-in-the-middle attack, the attacker spoofs the IP of a trusted host to intrude into the network.

Detection and Defense

At the ISP level, ingress filtering based on BCP38/RFC 2827 can block packets whose source addresses lie outside the network's own range. Configuring anti-spoofing rules on a firewall and adopting zero-trust security to provide authentication that does not rely on IP addresses alone are also effective. Protecting network equipment with strong random passwords to prevent tampering with the settings is a fundamental countermeasure as well.