Suggest an editImprove this articleRefine the answer for “What is IP spoofing?”. Your changes go to moderation before they’re published.Approval requiredContentWhat you’re changing🇺🇸EN🇺🇦UAPreviewTitle (EN)Short answer (EN)**IP spoofing** is a type of network attack in which the attacker forges the source IP address in network packets, posing as another device. **Key point:** IP spoofing is possible because the IP protocol does not verify that the source address is genuine.Shown above the full answer for quick recall.Answer (EN)Image**IP spoofing** is a type of network attack in which the attacker **forges the source IP address** in network packets, posing as another device. In simple terms: *the packet looks as if it came from a trusted computer, but it was actually sent by the attacker.* --- ## How IP spoofing works Every IP packet has a **"source IP address"** field. With IP spoofing, the attacker: - inserts **someone else's or a forged IP address**; - sends packets with that address into the network. As a result: - the recipient **trusts the packet**; - the real source of the attack **is hidden**. --- ## Why IP spoofing is used ### Main goals: - bypass IP-based filtering; - pose as a trusted host; - hide the real source of the attack; - amplify DDoS attacks. IP spoofing is often **not a standalone attack**, but part of a more complex one. --- ## Examples of using IP spoofing ### 1. Bypassing trust If a system trusts certain IP addresses: - the attacker forges such an address; - and gains access or sends malicious data. --- ### 2. DDoS attacks - packets are sent with forged IPs; - the source is hard to determine; - defense and blocking become harder. --- ### 3. Reflected attacks (amplification) - a request is sent with the victim's forged IP; - the server replies to the victim; - the load is amplified many times over. --- ## Which security properties are violated - **Integrity** - trust in the source is broken; - **Availability** - when used in DoS/DDoS; - indirectly - **Confidentiality**, if the attack is used to gain access. --- ## Why IP spoofing is possible Because: - the IP protocol **does not verify** that the source address is genuine; - authenticity checking is not built into base IP. --- ## How to defend against IP spoofing ### Main defense measures: - traffic filtering (ingress / egress filtering); - firewall and ACL; - connection state checking (stateful firewall); - using encrypted and authenticated protocols. On a normal network, **packets with a forged IP should never leave it**.For the reviewerNote to the moderator (optional)Visible only to the moderator. Helps review go faster.