I've read that IP spoofing is often used in denial of service attacks, and I've also just recently read about ingress filtering, which attempts to use blacklisting to filter out spoofed IP addresses to defend against DDoS attacks. I'm wondering how spoofing comes into play in DDoS attacks. Isn't it usually zombie computers infected with worms launching pings or TCP SYN packets? How would those packets be detected as spoofed when they're coming directly from the zombie computers? It seems like they would read as perfectly valid IP addresses, the IP addresses of the zombie computers. Where does spoofing enter the picture?

  • Where have you read this about DoS? Are you aware that there is a DoS attack that is designed to attack the spoofed IP?
    – schroeder
    Dec 28, 2015 at 18:39
  • Wikipedia, I think.
    – Zen Hacker
    Dec 28, 2015 at 18:41
  • I think you are combining a few different concepts. It will help us (and you) if you could cite the source so that we all can be clear about what we are talking about. Citing your sources will also show the research effort you have put into your own question.
    – schroeder
    Dec 28, 2015 at 18:43

1 Answer 1


There are several kinds of DDOS attacks and IP spoofing is used in reflection and amplification attacks. In these attacks the attacker sends a small request with a spoofed source IP address to some servers and these send a much bigger response to alleged sender of the request, i.e. the spoofed IP address. This way an attacker can cause a bandwidth eating attack against some target by using only a small bandwidth himself. TCP SYN does not matter here because these attacks are done with UDP and not TCP. For more information read about NTP-based DDoS attacks or DNS-based DDOS attacks.

  • So operation of a botnet wouldn't count as spoofing?
    – Zen Hacker
    Dec 28, 2015 at 18:47
  • 5
    @ZenHacker: Again, there are several kinds of DDOS attacks and only some of them use IP spoofing. The operation of a botnet by itself has nothing to do with IP spoofing. But a specific attack originating from a botnet might use IP spoofing. Dec 28, 2015 at 18:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .