This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?.

Are there valid reasons to spoof an address?

  • 1
    I would take a look at the question what-security-risks-does-ip-spoofing-bring . I feel these questions are very similar, if not duplicate?
    – Chris Dale
    Dec 9 '10 at 15:37
  • I think this question is different than your question. At first glance I only see risks; I'd like to know how a Corporate IT environment can benefit from IP address spoofing. Link: security.stackexchange.com/questions/1009/… Dec 9 '10 at 15:40
  • 2
    The two could easily meet in the middle, but the origins are different enough that the answers could be interesting.
    – Scott Pack
    Dec 9 '10 at 15:51

I found an article here which describes some legit examples for spoofing IP:

  • In mobile IP environments, where a roaming host must use a "home" IP address in a foreign network (ref. C. Perkins, "IP Mobility Support for IPv4)
  • virtual private networks that set the host IP to an address local to the organization's network
  • 1
    I updated the answer and added the old as a comment :)
    – Chris Dale
    Dec 9 '10 at 15:49
  • 2
    I don't see enough real-world justification for spoofing yet, and still don't think the need outweighs the risks involved. I hope more people post more details on how an application uses spoofing, and why those relying apps can't be upgraded to use something higher in the OSI stack. Dec 9 '10 at 23:56
  • which VPN do that?
    – curiousguy
    Jun 25 '12 at 19:38
  • If I'm not mistaken, listening for and responding to Anycast addresses might be considered spoofing as it appears that an otherwise unique address is present on two sides of a router
    – freddyb
    Oct 5 '12 at 20:06

Mobile IP networks are not really a justification for spoofing. RFC 2344 Reverse Tunneling provides an answer to allow Mobile IP to work with ingress filtering / antispoofing protection.

I'm not sure of current recommendations but old (2000) RFCs like RFC 3013 ISP recommendations recommend ingress and egress filtering to stop spoofing.

I don't think there is a real legitimate reason for spoofing on the public internet. Occasionally, private intranets might have a reason, just like they have a reason to do arp-proxying (a router masquerades as a host and forwards the packets) sometimes.

  • "Mobile IP networks are not really a justification for spoofing. RFC 2344 Reverse Tunneling provides an answer to allow Mobile IP to work with ingress filtering / antispoofing protection." An answer for antispoofing hardly make spoofing not justified.
    – curiousguy
    Jun 25 '12 at 19:40
  • Huh? Mobile IP was put forth as a justification for spoofing, but the justification doesn't exist because there are ways to do mobile IP without spoofing. Jun 27 '12 at 19:42
  • "Mobile IP was put forth as a justification for spoofing" yes, and it is a valid justification. "there are ways to do mobile IP without spoofing" so?
    – curiousguy
    Jun 27 '12 at 19:43
  • What are you confused about? Jun 27 '12 at 19:48
  • What constitutes a "justification" for something?
    – curiousguy
    Jun 27 '12 at 20:19

One possible usage scenario is a corporate internet filtering environment which is not configured inline (that is between the internet and users) but monitors traffic off a network SPAN/TAP.

In this scenario, when a user visits a site the web filtering environment has listed on a block list, the web filtering application may spoof the source IP of the web server and send a TCP reset packet back to the client, web server, or both, to kill the connection.

Websense web filtering products can operate in this way, for example.

  • oh. That's pretty nasty. I can see people just constantly hitting refresh and being frustrated as to why the internet doesn't work. Jun 27 '12 at 19:43
  • Typically you would only block certain sites, otherwise you would just block web access for those users completely on a firewall/router. Most web filtering products will serve a block page as well, so the user gets some feedback. Also, if it only sends the RST back to the user, you should be able to drop those packets using a host-based firewall which can bypass the block.
    – lew
    Jun 28 '12 at 6:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.