DDoS attacks via spoofed DNS(sec) are daily news for the last few years, but packet filtering should prevent IP spoofing on the internet.

I tried (as an exercise) to spoof a packet on my VPS and on my local ISP (With NAT disabled) but both were filtering out these packets (Wireshark did not show the packet on either opposite sides, any other ways to test this? like a online service?).

Anyway, I was wondering if there are any statistics/information about the usage of packet filtering usage? Why are there still so many attacks meanwhile I get the impression that most direct connections to the WWW are filtering out these packets?

  • 2
    I don't have any numbers but this is one of those cases where it only takes a small proportion of networks to be badly run to cause problems. Dec 17, 2015 at 14:13
  • 1
    bcp38.info/index.php/Main_Page would likely be a good place to get info about this kind of thing.. Dec 17, 2015 at 14:15
  • UDP doesn't specify the return IP address at the packet level, and thus there is no way to guarantee the source IP of a packet. Your ISP has to simply let these packets through. If you send UDP packets from behind a router (hardware firewall), it will open a port and will blindly route incoming UDP traffic through that open port back to the device. You can learn more about the differences by researching "TCP vs UDP hole punching". Dec 17, 2015 at 19:21
  • Why do you think your ISP performed filtering? Are DDoS attacks done using spoofed addresses? Can you provide any sources for these statements? It will be difficult to respond with statistics when it's possible the situation doesn't exist.
    – schroeder
    Dec 18, 2015 at 2:58

1 Answer 1


The reason that you were not able to spoof your source IP address is probably because your ISP uses uRPF (Unicast Reverse Path Forwarding) or some other type of IP validation filtering before routing your traffic.

uRPF Info: http://www.cisco.com/web/about/security/intelligence/unicast-rpf.html

Quote block from the uRPF page on Cisco: "Network administrators can use Unicast Reverse Path Forwarding (Unicast RPF) to help limit the malicious traffic on an enterprise network. This security feature works by enabling a router to verify the reachability of the source address in packets being forwarded. This capability can limit the appearance of spoofed addresses on a network. If the source IP address is not valid, the packet is discarded."

Since you're not using a sketchy ISP that does not provide these services, you're not able to spoof your IP address successfully. At this time, IP address spoofing can be exploited on around 25% of ISP's worldwide (http://spoofer.caida.org/faq.php.)

The biggest issue is that there is no way for legitimate ISP's to verify that all inbound traffic is legitimate (not spoofed).

You're looking for spoofing stats? Here's the place to look: http://spoofer.caida.org/summary.php

You're wanting more info about spoofing and why it's an issue? Here's the place to look: http://spoofer.caida.org/faq.php

Also, if you're looking to test to verify that your ISP's DNS servers are not vulnerable to DNS spoofing, check out GRC's DNS Nameserver Spoofability Test: https://www.grc.com/dns/dns.htm

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .