Do WPA-Enterprise implementations have built-in anti-IP-spoofing?

Question

i'd like to know if WPA-Enterprise implementations have built-in anti-IP-spoofing. here's what i mean:

it seems to me like IP spoofing should be easily detectable and handled under WPA-Enterprise. when you've authenticated, the router knows that your personal encryption credentials are associated to the IP it grants you, say 1.2.3.4. thus if a packet not encrypted with your credentials comes in with source 1.2.3.4, it's not from you but from a spoofer; if a packet encrypted with your credentials comes in with source other than 1.2.3.4, you're a spoofer; and last but not least, no one can send a packet encrypted with someone else's credentials.

given the above, i'd like to know

1. is my understanding correct (i.e., can one easily identify IP spoofers and IP spoofed packets under WPA-Enterprise)?
2. is it standard/common or unheard of/uncommon for routers to drop/reject spoofed packets under WPA-Enterprise?
3. in the latter case, does anyone know of any (ideally OpenWRT-compatible) packages that do this or alternatively have any pointers about where to start to implement one?

thanks!

Answer 1

I don't think there is any inherit protection against IP address spoofing in a WPA-Enterprise environment and from a security preservative, this doesn't really matter because there are other implicit mitigations against ip address spoofing. Snort and other NDIS solutions have rule-sets to detect IP spoofing, and ARP table poisoning. These technologies are usually deployed in an enterprise environment.

Being able to spoof the ip address of another member on the network isn't very helpful if you can't see the response. WPA-Enterprise uses a unique key for each member on the network so you cannot see the response (and you could see this repose if the wifi was unencrypted).

MAC address spoofing and ARP table poising are much MUCH bigger threat than ip address spoofing. You can always forge a packet with an arbitrary source address, if you are unable to receive traffic on this IP address then you cannot complete the TCP three way handshake, and thus unable to establish a TCP connection. UDP and ICMP are fair game, but even then there is a very limited impact.