What Is IP Spoofing?
IP spoofing forges the source address in a packet’s header so it appears to come from a different host. Because the IP protocol never verifies who actually sent a packet, an attacker can make traffic look like it originates anywhere. It is a building block of several attacks — most notably the amplification DDoS — and a reason the network layer cannot be trusted on address alone.
How does IP spoofing work?#
The source IP field in a packet is just data the sender fills in, and nothing in basic IP checks it. An attacker sets it to a chosen address:
- To hide — obscure the true origin of an attack.
- To impersonate — pose as a trusted host that a target grants access to.
- To reflect — set the source to a victim’s address so that responses flood the victim.
That last use is the engine of reflection/amplification DDoS: send small spoofed requests to services that reply with large responses, all aimed at the victim whose address you forged.
Why is spoofing limited — and how is it countered?#
Spoofing is one-directional: replies go to the forged address, not the attacker, so it is poor for interactive communication but ideal for floods and fire-and-forget attacks. The main network-level defense is filtering:
| Control | Effect |
|---|---|
| Ingress filtering (BCP 38) | ISPs drop packets with implausible source IPs |
| Egress filtering | Stop spoofed packets leaving your network |
| Anti-spoofing on routers | Reject addresses that can’t be on that interface |
IP spoofing is a network-layer forgery underpinning DDoS and impersonation. More at the Network Security hub.
Frequently asked questions#
What is IP spoofing?
IP spoofing is forging the source IP address in a packet’s header so it appears to come from a different host. Because IP itself does not verify source addresses, an attacker can send packets that look like they originate elsewhere — used to hide their identity, impersonate a trusted host, or amplify denial-of-service attacks.
What attacks rely on IP spoofing?
Amplification and reflection DDoS attacks depend on it: the attacker spoofs the victim’s address so responses flood the victim. It also underpins some session-hijacking and trust-based attacks where a system trusts traffic from a particular IP. Spoofing is hard to use for two-way communication because replies go to the forged address.