4

I've read that IP spoofing is often used in denial of service attacks, and I've also just recently read about ingress filtering, which attempts to use blacklisting to filter out spoofed IP addresses to defend against DDoS attacks. I'm wondering how spoofing comes into play in DDoS attacks. Isn't it usually zombie computers infected with worms launching pings or TCP SYN packets? How would those packets be detected as spoofed when they're coming directly from the zombie computers? It seems like they would read as perfectly valid IP addresses, the IP addresses of the zombie computers. Where does spoofing enter the picture?

  • Where have you read this about DoS? Are you aware that there is a DoS attack that is designed to attack the spoofed IP? – schroeder Dec 28 '15 at 18:39
  • Wikipedia, I think. – Zen Hacker Dec 28 '15 at 18:41
  • I think you are combining a few different concepts. It will help us (and you) if you could cite the source so that we all can be clear about what we are talking about. Citing your sources will also show the research effort you have put into your own question. – schroeder Dec 28 '15 at 18:43
4

There are several kinds of DDOS attacks and IP spoofing is used in reflection and amplification attacks. In these attacks the attacker sends a small request with a spoofed source IP address to some servers and these send a much bigger response to alleged sender of the request, i.e. the spoofed IP address. This way an attacker can cause a bandwidth eating attack against some target by using only a small bandwidth himself. TCP SYN does not matter here because these attacks are done with UDP and not TCP. For more information read about NTP-based DDoS attacks or DNS-based DDOS attacks.

  • So operation of a botnet wouldn't count as spoofing? – Zen Hacker Dec 28 '15 at 18:47
  • 5
    @ZenHacker: Again, there are several kinds of DDOS attacks and only some of them use IP spoofing. The operation of a botnet by itself has nothing to do with IP spoofing. But a specific attack originating from a botnet might use IP spoofing. – Steffen Ullrich Dec 28 '15 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.