Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

According to:

"this technique is mainly used when the attacker does not care about the response or the attacker has some way of guessing the response."

My Question is:
"or the attacker has some way of guessing the response"
?? How?

not counting that the machine behind the spoofed ip address is hacked by the attacker.

share|improve this question
up vote 10 down vote accepted

Sometimes the connection information inside a packet is predictable. TCP initial sequence numbers, for example, can be an issue if they are not random. See for one example. The same thing can also happen with DNS request ids.

Usually these attacks don't work on the first try, but will with several tries in quick succession. If you know that Bob just asked Alice where resolves to, and you know the request id, you can tell Bob that it is your server by sending a packet that claims to be from Alice's IP address.

share|improve this answer

An example could be spoofing as part of a denial of service attack such as a Smurf Attack. The attacker knows what the respons will be, and where it will go, so doesn't need to receive it himself.

share|improve this answer
That would apply to the first part of the quote: "does not care about the response". But the OP was asking how "the attacker has some way of guessing"... – AviD May 3 '11 at 12:55
@AviD - I was meaning the attacker would know exactly what the response would be, but you're point is also true. Will pop something else up in a bit... – Rory Alsop May 3 '11 at 12:56
@RoryAlsop,please coud you take a look here and suggest a cool – user1369975 Feb 3 '14 at 15:54

An example of this guessing game is the now famous DNS flaw that Dan Kaminsky found in almost all dns implementations a few years ago (2008).

Basically the flaw could be exploited by shoving many replies to a forced dns request at a requesting server until one happened to have the correct return port and sequence (guessing is easier when you can do it thousands of times). Obviously this explanation is a long way from the complete story, see below for a far better argued explanation.

The Security Now Epsode 155 where Steve Gibson explained the flaw

share|improve this answer

If you're spoofing someone else's IP, chances are you aren't going to receive traffic back for that IP that your spoofing creates. You might want the spoofed machine that owns the IP to receive this traffic back though, say because you're conducting a denial of service attack.

(Silly example) Let's say you wanted a target machine to receive a million DNS responses. You construct a DNS query you know will result in a verbose response (so you are predicting the response because you are engineering it), you spoof the IP of the victim machine, and you send your query to a million DNS servers who all try to send their responses back to the spoofed machine. The victim machine is overwhelmed by the traffic it is getting because its IP was used in the attack.

People often mistake IP spoofing with Man-in-the-middle. In IP spoofing you're not standing in for the original machine, rather you're crediting it with whatever you're doing, this contrasted with Man-in-the-middle where you are actually spoofing two machines' IP, one is often a router and the other the target, and you act as intermediary, or man-in-the-middle between the two.

In the first case you don't care about the traffic your spoofing generates, whereas, in the second case you do.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.