IP Address spoofing?

Question

According to:
https://secure.wikimedia.org/wikipedia/en/wiki/IP_address_spoofing

"this technique is mainly used when the attacker does not care about the response or the attacker has some way of guessing the response."

My Question is:
"or the attacker has some way of guessing the response"
?? How?

not counting that the machine behind the spoofed ip address is hacked by the attacker.

Answer 1

Sometimes the connection information inside a packet is predictable. TCP initial sequence numbers, for example, can be an issue if they are not random. See http://www.networkcomputing.com/unixworld/security/001.txt.html for one example. The same thing can also happen with DNS request ids.

Usually these attacks don't work on the first try, but will with several tries in quick succession. If you know that Bob just asked Alice where google.com resolves to, and you know the request id, you can tell Bob that it is your server by sending a packet that claims to be from Alice's IP address.

Answer 2

An example could be spoofing as part of a denial of service attack such as a Smurf Attack. The attacker knows what the respons will be, and where it will go, so doesn't need to receive it himself.

Answer 3

An example of this guessing game is the now famous DNS flaw that Dan Kaminsky found in almost all dns implementations a few years ago (2008).

Basically the flaw could be exploited by shoving many replies to a forced dns request at a requesting server until one happened to have the correct return port and sequence (guessing is easier when you can do it thousands of times). Obviously this explanation is a long way from the complete story, see below for a far better argued explanation.

The Security Now Epsode 155 where Steve Gibson explained the flaw