15

This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?.

Are there valid reasons to spoof an address?

3
  • 1
    I would take a look at the question what-security-risks-does-ip-spoofing-bring . I feel these questions are very similar, if not duplicate?
    – Chris Dale
    Dec 9, 2010 at 15:37
  • I think this question is different than your question. At first glance I only see risks; I'd like to know how a Corporate IT environment can benefit from IP address spoofing. Link: security.stackexchange.com/questions/1009/… Dec 9, 2010 at 15:40
  • 2
    The two could easily meet in the middle, but the origins are different enough that the answers could be interesting.
    – Scott Pack
    Dec 9, 2010 at 15:51

3 Answers 3

7

I found an article here which describes some legit examples for spoofing IP:

  • In mobile IP environments, where a roaming host must use a "home" IP address in a foreign network (ref. C. Perkins, "IP Mobility Support for IPv4)
  • virtual private networks that set the host IP to an address local to the organization's network
4
  • 1
    I updated the answer and added the old as a comment :)
    – Chris Dale
    Dec 9, 2010 at 15:49
  • 2
    I don't see enough real-world justification for spoofing yet, and still don't think the need outweighs the risks involved. I hope more people post more details on how an application uses spoofing, and why those relying apps can't be upgraded to use something higher in the OSI stack. Dec 9, 2010 at 23:56
  • which VPN do that?
    – curiousguy
    Jun 25, 2012 at 19:38
  • If I'm not mistaken, listening for and responding to Anycast addresses might be considered spoofing as it appears that an otherwise unique address is present on two sides of a router
    – freddyb
    Oct 5, 2012 at 20:06
5

Mobile IP networks are not really a justification for spoofing. RFC 2344 Reverse Tunneling provides an answer to allow Mobile IP to work with ingress filtering / antispoofing protection.

I'm not sure of current recommendations but old (2000) RFCs like RFC 3013 ISP recommendations recommend ingress and egress filtering to stop spoofing.

I don't think there is a real legitimate reason for spoofing on the public internet. Occasionally, private intranets might have a reason, just like they have a reason to do arp-proxying (a router masquerades as a host and forwards the packets) sometimes.

9
  • "Mobile IP networks are not really a justification for spoofing. RFC 2344 Reverse Tunneling provides an answer to allow Mobile IP to work with ingress filtering / antispoofing protection." An answer for antispoofing hardly make spoofing not justified.
    – curiousguy
    Jun 25, 2012 at 19:40
  • Huh? Mobile IP was put forth as a justification for spoofing, but the justification doesn't exist because there are ways to do mobile IP without spoofing. Jun 27, 2012 at 19:42
  • "Mobile IP was put forth as a justification for spoofing" yes, and it is a valid justification. "there are ways to do mobile IP without spoofing" so?
    – curiousguy
    Jun 27, 2012 at 19:43
  • What are you confused about? Jun 27, 2012 at 19:48
  • What constitutes a "justification" for something?
    – curiousguy
    Jun 27, 2012 at 20:19
2

One possible usage scenario is a corporate internet filtering environment which is not configured inline (that is between the internet and users) but monitors traffic off a network SPAN/TAP.

In this scenario, when a user visits a site the web filtering environment has listed on a block list, the web filtering application may spoof the source IP of the web server and send a TCP reset packet back to the client, web server, or both, to kill the connection.

Websense web filtering products can operate in this way, for example.

2
  • oh. That's pretty nasty. I can see people just constantly hitting refresh and being frustrated as to why the internet doesn't work. Jun 27, 2012 at 19:43
  • Typically you would only block certain sites, otherwise you would just block web access for those users completely on a firewall/router. Most web filtering products will serve a block page as well, so the user gets some feedback. Also, if it only sends the RST back to the user, you should be able to drop those packets using a host-based firewall which can bypass the block.
    – lew
    Jun 28, 2012 at 6:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.