What is IP spoofing?

IP spoofing is a type of network attack in which the attacker forges the source IP address in network packets, posing as another device.

In simple terms: the packet looks as if it came from a trusted computer, but it was actually sent by the attacker.

---

#How IP spoofing works

Every IP packet has a "source IP address" field. With IP spoofing, the attacker:

• inserts someone else's or a forged IP address;
• sends packets with that address into the network.

As a result:

• the recipient trusts the packet;
• the real source of the attack is hidden.

---

#Why IP spoofing is used

#Main goals:

• bypass IP-based filtering;
• pose as a trusted host;
• hide the real source of the attack;
• amplify DDoS attacks.

IP spoofing is often not a standalone attack, but part of a more complex one.

---

#Examples of using IP spoofing

#1. Bypassing trust

If a system trusts certain IP addresses:

• the attacker forges such an address;
• and gains access or sends malicious data.

---

#2. DDoS attacks

• packets are sent with forged IPs;
• the source is hard to determine;
• defense and blocking become harder.

---

#3. Reflected attacks (amplification)

• a request is sent with the victim's forged IP;
• the server replies to the victim;
• the load is amplified many times over.

---

#Which security properties are violated

• Integrity - trust in the source is broken;
• Availability - when used in DoS/DDoS;
• indirectly - Confidentiality, if the attack is used to gain access.

---

#Why IP spoofing is possible

Because:

• the IP protocol does not verify that the source address is genuine;
• authenticity checking is not built into base IP.

---

#How to defend against IP spoofing

#Main defense measures:

• traffic filtering (ingress / egress filtering);
• firewall and ACL;
• connection state checking (stateful firewall);
• using encrypted and authenticated protocols.

On a normal network, packets with a forged IP should never leave it.