I've read that IP spoofing is often used in denial of service attacks, and I've also just recently read about ingress filtering, which attempts to use blacklisting to filter out spoofed IP addresses to defend against DDoS attacks. I'm wondering how spoofing comes into play in DDoS attacks. Isn't it usually zombie computers infected with worms launching pings or TCP SYN packets? How would those packets be detected as spoofed when they're coming directly from the zombie computers? It seems like they would read as perfectly valid IP addresses, the IP addresses of the zombie computers. Where does spoofing enter the picture?
There are several kinds of DDOS attacks and IP spoofing is used in reflection and amplification attacks. In these attacks the attacker sends a small request with a spoofed source IP address to some servers and these send a much bigger response to alleged sender of the request, i.e. the spoofed IP address. This way an attacker can cause a bandwidth eating attack against some target by using only a small bandwidth himself. TCP SYN does not matter here because these attacks are done with UDP and not TCP. For more information read about NTP-based DDoS attacks or DNS-based DDOS attacks.