This is a corollary to the question Why don't ISPs filter on source address to prevent spoofing?.
Are there valid reasons to spoof an address?
-
1I would take a look at the question what-security-risks-does-ip-spoofing-bring . I feel these questions are very similar, if not duplicate?– Chris DaleCommented Dec 9, 2010 at 15:37
-
I think this question is different than your question. At first glance I only see risks; I'd like to know how a Corporate IT environment can benefit from IP address spoofing. Link: security.stackexchange.com/questions/1009/…– makerofthings7Commented Dec 9, 2010 at 15:40
-
2The two could easily meet in the middle, but the origins are different enough that the answers could be interesting.– Scott PackCommented Dec 9, 2010 at 15:51
Add a comment
|
3 Answers
I found an article here which describes some legit examples for spoofing IP:
- In mobile IP environments, where a roaming host must use a "home" IP address in a foreign network (ref. C. Perkins, "IP Mobility Support for IPv4)
- virtual private networks that set the host IP to an address local to the organization's network
answered Dec 9, 2010 at 15:30
-
1
-
2I don't see enough real-world justification for spoofing yet, and still don't think the need outweighs the risks involved. I hope more people post more details on how an application uses spoofing, and why those relying apps can't be upgraded to use something higher in the OSI stack. Commented Dec 9, 2010 at 23:56
-
-
If I'm not mistaken, listening for and responding to Anycast addresses might be considered spoofing as it appears that an otherwise unique address is present on two sides of a router– freddybCommented Oct 5, 2012 at 20:06
Mobile IP networks are not really a justification for spoofing. RFC 2344 Reverse Tunneling provides an answer to allow Mobile IP to work with ingress filtering / antispoofing protection.
I'm not sure of current recommendations but old (2000) RFCs like RFC 3013 ISP recommendations recommend ingress and egress filtering to stop spoofing.
I don't think there is a real legitimate reason for spoofing on the public internet. Occasionally, private intranets might have a reason, just like they have a reason to do arp-proxying (a router masquerades as a host and forwards the packets) sometimes.
answered Dec 10, 2010 at 20:36
-
"Mobile IP networks are not really a justification for spoofing. RFC 2344 Reverse Tunneling provides an answer to allow Mobile IP to work with ingress filtering / antispoofing protection." An answer for antispoofing hardly make spoofing not justified. Commented Jun 25, 2012 at 19:40
-
Huh? Mobile IP was put forth as a justification for spoofing, but the justification doesn't exist because there are ways to do mobile IP without spoofing. Commented Jun 27, 2012 at 19:42
-
"Mobile IP was put forth as a justification for spoofing" yes, and it is a valid justification. "there are ways to do mobile IP without spoofing" so? Commented Jun 27, 2012 at 19:43
-
-
One possible usage scenario is a corporate internet filtering environment which is not configured inline (that is between the internet and users) but monitors traffic off a network SPAN/TAP.
In this scenario, when a user visits a site the web filtering environment has listed on a block list, the web filtering application may spoof the source IP of the web server and send a TCP reset packet back to the client, web server, or both, to kill the connection.
Websense web filtering products can operate in this way, for example.
-
oh. That's pretty nasty. I can see people just constantly hitting refresh and being frustrated as to why the internet doesn't work. Commented Jun 27, 2012 at 19:43
-
Typically you would only block certain sites, otherwise you would just block web access for those users completely on a firewall/router. Most web filtering products will serve a block page as well, so the user gets some feedback. Also, if it only sends the RST back to the user, you should be able to drop those packets using a host-based firewall which can bypass the block.– lewCommented Jun 28, 2012 at 6:20