What Is IP Spoofing? Forging the Return Address
IP spoofing is the technique of creating IP packets with a forged source address, making them appear to come from a different IP than the actual sender. It’s like mailing a letter with someone else’s return address. The recipient thinks the letter came from that other address, and any response goes there too. IP spoofing is used in DDoS amplification attacks, reflection attacks, and certain types of session hijacking. The internet’s original design didn’t include source address verification because the network was built on trust between a small number of academic institutions. That design decision continues to cause problems decades later.
How It Works
IP packets contain a source address field that the sender fills in. In normal operation, this is the sender’s real IP. But the protocol doesn’t verify it. Any device can put any IP address in the source field, and most routers will forward the packet without checking whether the source address is legitimate.
This enables several attack patterns:
DDoS amplification: The attacker sends small requests to public servers (DNS, NTP, Memcached) with the victim’s IP as the source. The servers send their much larger responses to the victim. The victim gets flooded with traffic they never requested.
Reflection attacks: Similar to amplification but without the size multiplication. Just redirect response traffic to the victim.
SYN floods: Send TCP SYN packets with random spoofed source IPs. The target sends SYN-ACK responses to addresses that never complete the handshake, exhausting connection resources.
Bypassing IP-based authentication: Some legacy systems grant access based on source IP. Spoofing lets attackers forge an authorized IP (though they won’t receive responses without additional attack techniques).
Defense: BCP38 and Ingress Filtering
The primary defense against IP spoofing is BCP38 (RFC 2827), which recommends that ISPs and network operators implement ingress filtering. This means checking outgoing packets and dropping any with source addresses that don’t belong to the network.
If your ISP allocates the 198.51.100.0/24 block to its customers, the ISP’s routers should drop any outgoing packet from a customer that claims a source address outside that block. The customer can’t spoof addresses from other networks.
BCP38 adoption has improved but is still not universal. As of 2026, roughly 75% of networks implement some form of source address validation. The remaining 25% are where most spoofed traffic originates.
Test It Yourself
Check Your IP
See your real IP address and understand what attackers would see if targeting your address.