Can a source IP address be spoofed?¶
title: "Can a source IP address be spoofed?" card_id: "IP-020" status: "complete" source_document: "https://docs.google.com/document/d/18wx2i9o3hga9Izi4vPsi8499eihy99Agz1d3V6Y0R3Y/edit?usp=drivesdk"
Can a source IP address be spoofed?¶
Can a source IP address be spoofed?¶
Yes. The source IP address written into an individual packet can be falsified.
That’s known as source IP spoofing.
Every IP packet contains a source address and a destination address.
The destination address tells the network where the packet is going. The source address says where it came from and where any reply should be sent.
Normally, the source address represents the network connection that sent the packet. But it’s possible to create a packet containing somebody else’s IP address instead.
If the receiving system records that packet, its log may show the false address because that’s what appeared in the packet header.
There’s an obvious practical problem, though.
Any reply will be sent to the spoofed address, not back to the actual sender.
That matters because different types of communication work in different ways.
With connectionless traffic, such as UDP, a device can send a packet without first completing a conversation with the receiving system.
The sender may not need to receive a reply at all.
Alternatively, sending the reply somewhere else may be the whole point.
This happens in reflection and amplification attacks.
An attacker sends requests to internet services but replaces their own source address with the victim’s address. The services then send their replies to the victim.
The victim appears to have made the requests, even though they didn’t.
TCP works differently.
Before most TCP communication can begin, the two systems perform a three-way handshake.
One system sends a connection request. The receiving system responds to the source IP address in that request. The first system must then reply correctly before the connection is established.
If the source address has simply been spoofed, the response goes to the false address. The actual sender normally won’t see it and won’t be able to complete the handshake.
That makes simple source IP spoofing a poor explanation for a completed TCP session, such as a successful website login, upload or other activity requiring an ongoing two-way exchange.
It isn’t impossible in every conceivable situation. Someone able to see or redirect the returning traffic may overcome that problem. But that’s more complicated than simply placing a false source address into a packet.
Spoofing also shouldn’t be confused with using a VPN, proxy or NAT.
Those systems establish genuine connections and pass traffic onwards. The service may see an intermediary or shared public address, but that address hasn’t simply been forged in the packet received by the service.
Network providers may also apply filtering intended to block packets containing source addresses that shouldn’t be coming from their networks. That reduces spoofing, but it doesn’t mean every network prevents it.
So the type of record matters.
A firewall recording a single inbound packet may only show the source address written into that packet.
A successfully completed two-way session provides stronger evidence that the sender could receive and respond to traffic through that network path.
It still doesn’t identify the person responsible, but it makes simple source IP spoofing much less likely.