🎭 04-02: IP Spoofing in Attacks¶

📌 Recap: What Is IP Spoofing?¶

As introduced in 02-06: IP Spoofing Fundamentals, IP spoofing means putting a false source IP address into a packet — claiming to be someone (or something) you're not. IP was designed without any built-in mechanism to verify that the source address field is truthful, which is exactly what makes this possible at all.

This lesson focuses on how attackers actually put that weakness to use in real attacks, building directly on the SYN flooding attack from 04-01: TCP SYN Flooding.

Not all IP spoofing is the same — the key distinction is whether the attacker can see the responses to their forged packets.

The attacker forges packets but has no visibility into the return traffic — the responses go somewhere else entirely (to the real owner of the spoofed IP, or to a nonexistent address).

Attacker (spoofing IP "X") ──────── SYN ─────────▶ Server
Server ────────── SYN-ACK ─────────▶ (goes to the REAL owner of IP "X",
                                       not back to the attacker)

👉 This is called "blind" because the attacker is operating without feedback — they can send forged packets all day, but they never see how the target responds. This is exactly the situation in a SYN flood: the attacker doesn't want to see the SYN-ACKs, they just want to consume server resources.

Blind spoofing is also used in attacks that require guessing hidden values (like TCP sequence numbers) since the attacker can't simply read the answer off the wire — covered in 04-03: TCP Session Hijacking.

On-Path Spoofing¶

The attacker is positioned somewhere that lets them observe legitimate traffic between the two real parties — for example, via ARP spoofing (see 03-04: ARP Spoofing Attacks) or by sitting on a shared network segment.

Victim A ──── traffic ────▶ Victim B
       ▲
       │ (attacker can see/sniff this exchange)
   Attacker

👉 Because the attacker can directly observe real sequence numbers, ports, and other session details, they don't need to guess anything — they simply read the correct values off the wire and forge a perfectly-matching packet. This is far more reliable and is the basis of attacks like 04-04: RST Injection and session hijacking.

	Blind Spoofing	On-Path Spoofing
Can see responses?	No	Yes
Needs to guess hidden fields (seq #, ports)?	Yes	No — reads them directly
Typical use	SYN floods, blind hijacking	RST injection, active hijacking, sniff-and-spoof
Positioning required	None — works from anywhere on the internet	Must be on the network path (LAN, ISP, compromised router, etc.)

🔥 Why SYN Floods Usually Spoof the Source¶

Looking back at the SYN flood attack, spoofing the source IP serves two distinct purposes simultaneously:

Hiding the attacker's real identity. If every SYN packet carried the attacker's true IP, the victim (or their upstream provider) could simply block that one address, immediately neutralizing the attack. Spoofing makes each packet look like it came from a different, often innocent, machine.
Preventing the SYN-ACK from ever being answered. This is subtler but just as important: if the attacker used their real IP, their own operating system would receive the server's unsolicited SYN-ACK and — not recognizing it as part of any connection it initiated — automatically send back a RST (reset) packet, tearing down the half-open connection prematurely and defeating the whole point of the attack. By spoofing a source the attacker doesn't control, that automatic RST never happens, and the half-open connection lingers in the server's queue as intended.

💡 This is a great example of how a single trick (forging a source address) can serve both an evasion goal and a mechanical goal for the attack to actually function.

🕸️ How Spoofing Complicates Attribution and Defense¶

IP spoofing makes life significantly harder for defenders in several concrete ways:

Attribution becomes unreliable. The source IP in a captured packet cannot be trusted as evidence of who sent it — a core assumption defenders often wrongly rely on.
IP-based blocking (blacklisting) is far less effective. Blocking one spoofed source IP does nothing, because the next packet may claim a completely different, random source.
Distinguishing attack traffic from legitimate traffic is harder. A flood of packets from thousands of "different" source IPs can look superficially like a spike in legitimate traffic from many real users (this overlaps heavily with distributed denial-of-service, or DDoS, scenarios).
Backscatter affects innocent third parties. When a spoofed source IP belongs to a real, innocent host, that host may suddenly receive a flood of unsolicited SYN-ACK or RST replies it never asked for — collateral noise from an attack it isn't even the target of.

Why Isn't Spoofing Just... Blocked at the Network Level?¶

It technically can be, via a practice called BCP38 / ingress filtering (also called Source Address Validation): an ISP or network configures its routers to drop any outbound packet whose source IP doesn't actually belong to that network's assigned address block. If universally deployed, this would make most blind IP spoofing impossible at the source.

👉 In practice, adoption is inconsistent across the global internet — there's little direct incentive for a network operator to implement filtering that primarily protects other networks rather than their own, so spoofing-based attacks remain broadly viable today.

🖼️ Realistic Scenario¶

Security researchers investigating a SYN flood against a gaming server pull packet captures and see attack traffic apparently originating from thousands of unique IP addresses spread across dozens of countries. Initial instinct might be "this is a massive botnet." On closer inspection, many of these "source" addresses turn out to belong to address ranges that could not plausibly be sending this traffic (unallocated ranges, addresses geographically inconsistent with routing, or ranges known to be filtered elsewhere) — a strong signal that a much smaller number of attacking machines are simply forging random source addresses on every packet, not that a huge botnet is truly involved.

📌 Key Takeaways¶

IP spoofing means forging the source address field of a packet; it's possible because IP has no built-in source authentication.
Blind spoofing — the attacker cannot see responses to forged packets; used in SYN floods and scenarios requiring guessed values.
On-path spoofing — the attacker can observe real traffic (e.g., via ARP spoofing) and forges packets using directly observed, correct values; far more reliable.
SYN floods spoof source IPs both to hide the attacker's identity and to prevent an unwanted automatic RST from tearing down the half-open connection.
Spoofing undermines IP-based attribution and blacklisting, and can create "backscatter" noise affecting innocent third parties whose addresses were forged.
Ingress filtering (BCP38) can prevent spoofed packets from ever leaving a network, but adoption across the internet remains incomplete.
The next lessons build on spoofing directly: 04-03: TCP Session Hijacking and 04-04: RST Injection.