What is IP spoofing?

This page is about network addresses. Email spoofing and caller ID spoofing are different problems, outside a web filtering layer.

Every IP packet carries a source and a destination address. The sender writes both. Routers look at the destination to forward the packet and, unless the network was configured to, never ask whether the source address belongs to the sender.

A program with access to raw sockets can therefore write any source address it likes. The packet reaches its destination; any reply goes to the forged address, not back to the sender.

• Reflection and amplification. The attacker sends small requests to open servers with the victim's address as the source (see amplification attacks); the servers send larger replies to the victim. NTP amplification and memcached work this way.
• SYN floods. Connection requests from forged sources fill the victim's table of half-open connections, and the replies go nowhere; see SYN flood.
• Hiding the source. Random source addresses make blocking by address useless and tracing slow.

RFC 4732 describes spoofing as one of the conditions that make denial of service on the internet hard to stop.

An HTTP request travels over a TCP connection, and opening one needs a three-way handshake: the server replies to the source address and waits for an answer. With a forged source, the reply goes elsewhere and the connection never opens.

So the address on a web request is real, even when it belongs to a hijacked device or a proxy. That is why rate limits and filtering at layer 7 can count by address, and also why address alone says little about intent; see IP reputation.

Not reliably by the victim. A forged packet is well formed and its source field looks like any other. Some signs help: source addresses from ranges that are never routed on the public internet, a hop count that does not fit where the address supposedly is, and packets that never take part in a completed handshake.

Networks are in a better position. A provider knows which address ranges each customer link may use, so a packet arriving on the wrong link with someone else's source can be dropped on the spot. Researchers also watch for backscatter: replies sent by victims to the random addresses an attacker forged, which reveal floods happening elsewhere.

The fix belongs to networks, not to victims: a network should drop packets leaving it with a source address that is not its own. This is ingress filtering, described in BCP 38 and extended for networks with several upstream links in BCP 84.

Every network that applies it removes itself as a launch point for spoofed floods. The victim cannot fix spoofing; it can only absorb the result upstream, as described on DDoS protection.