🎭 02-06: IP Spoofing Fundamentals¶
📌 What Is IP Spoofing?¶
IP spoofing is the act of constructing a packet with a forged source IP address — putting an address in the "source" field of the IP header that does not actually belong to the device sending the packet.
Recall from 01-03: TCP/IP Model & Encapsulation that the IP header's source address field exists so the receiver knows where to send a reply. Spoofing abuses the fact that nothing forces this field to be accurate — it's simply a value the sending device writes into the packet before transmitting it.
💡 Analogy: it's like writing a fake return address on a physical letter. The postal service will still deliver the letter to the destination — it has no way of verifying the return address is real — but any reply will go to whoever actually owns that address, not back to you.
🔓 Why Is Spoofing Possible? IP Has No Built-In Authentication¶
When the Internet Protocol was designed, it was built to be simple and to work over an academic, trusted research network — not the hostile environment the modern internet has become. As a result:
- There is no field in the IP header that cryptographically proves who sent the packet.
- Routers along the path forward packets based on the destination address only — they generally do not verify that the source address is plausible for the network the packet arrived from.
- Any device with the right tools (raw sockets, or libraries like Scapy) can construct a packet with any source address it wants, exactly the same way it would construct a normal one — the "user-controllable fields" in a packet include the source address, and the operating system normally fills this in truthfully, but nothing stops software from overriding it.
💡 This is the same underlying issue you saw with ARP in 01-06: IPv6 Basics & Security and will see again with DNS in Module 06: a protocol field that nothing verifies is a protocol field that can be lied about. IP spoofing is simply this pattern applied to the most fundamental field in networking — the source address itself.
⚖️ Legitimate vs. Malicious Uses¶
It's worth knowing that not all "spoofing-adjacent" activity is an attack:
| Use | Legitimate? | Explanation |
|---|---|---|
| Load balancer / NAT source rewriting | ✔️ Legitimate | Infrastructure legitimately rewrites addresses as part of normal, authorized operation — not deceptive to the end systems involved |
| Penetration testing / research | ✔️ Legitimate (with authorization) | Security professionals spoof packets in controlled lab environments (like this course's labs) specifically to study and demonstrate vulnerabilities |
| Anonymizing an attack's true origin | ❌ Malicious | Hides the attacker's real IP address from logs and incident responders |
| Bypassing IP-based access control | ❌ Malicious | Pretends to be a trusted IP address to get past a firewall rule like "allow only traffic from 10.0.0.5" |
| DDoS amplification | ❌ Malicious | Forges the victim's IP as the source of requests to third-party servers, directing large responses at the victim (see 02-03) |
| Blind session hijacking / TCP resets | ❌ Malicious | Forges packets appearing to come from one side of an existing connection to inject data or kill it |
🧱 Why TCP Makes Spoofing Harder (But Not Impossible)¶
You might wonder: if source addresses can be forged so easily, why isn't the entire internet constantly hijacked? The answer lies back in the three-way handshake (02-01):
- If an attacker spoofs a SYN packet claiming to be from Victim V to Server S, the resulting SYN-ACK from S is sent to the real V, not to the attacker.
- The attacker never sees that SYN-ACK — meaning they don't know the server's chosen sequence number,
Y, and can't correctly complete the handshake with the rightack = Y + 1. - Blind spoofing against TCP therefore requires either guessing the sequence number (much harder now that operating systems randomize initial sequence numbers, as discussed in 02-02) or being positioned to actually see the traffic (e.g., via ARP spoofing putting the attacker on-path — Module 03).
UDP, by contrast, has no handshake at all to defeat — which is exactly why UDP-based protocols like DNS are such a common target for spoofing-based attacks.
🔭 Preview: Where Spoofing Shows Up Later in This Course¶
IP spoofing isn't a single attack — it's a foundational technique that many later attacks build on top of:
- 03-04: ARP Spoofing Attacks — technically a Layer 2 (MAC) spoofing attack, not IP spoofing, but it exists to achieve the same goal at a different layer: making a victim believe traffic is coming from — or should be sent to — the wrong place, in order to position the attacker on-path.
- 04-02: IP Spoofing in Attacks — a deep dive into concrete attacks that rely directly on forged source IP addresses, including SYN flooding, TCP reset attacks, and session hijacking scenarios.
For now, the key idea to carry forward is simple: the source IP address in any packet you didn't personally verify through some other mechanism (like a TLS certificate or a cryptographic handshake) should be treated as a claim, not a fact.
📌 Key Takeaways¶
- IP spoofing means forging the source address field of an IP packet so it doesn't reflect the sender's real address.
- It's possible because IP has no built-in authentication — routers forward based on destination address and generally don't verify that a packet's source address is genuine.
- Spoofing has legitimate uses in networking infrastructure and authorized security testing, but is also the basis for DDoS amplification, access-control bypass, and connection hijacking/reset attacks.
- TCP's three-way handshake makes blind spoofing much harder, because the attacker never sees the server's SYN-ACK and therefore doesn't know the correct sequence number to complete the connection.
- UDP's lack of a handshake makes it a much easier and more common target for spoofing-based attacks than TCP.
- IP spoofing is a foundational technique that reappears throughout the course — from ARP spoofing (Layer 2) to SYN flooding and session hijacking (Layer 3/4) to DNS spoofing (Layer 7).
- Treat any unverified source address as a claim, not a guarantee — this mindset is the throughline connecting almost every attack covered in Modules 03–06.