I want to know the other attacks which are associated with IP spoofing because, we're trying to implement Source Address Validation (SAVA) and wanted to where else can Source Address validation techniques can be used? This is for a Project purpose and any recent references/suggestions will be very helpful.

  • A short look at wikipedia would tell you that it can also be used to defeat IP based authentication. I recommend that you do more research by your own first. – Steffen Ullrich Jan 10 '16 at 7:04

The two major attack vectors that spring to mind are Non-Blind and Blind spoofing, which make use of spoofed IP's and TCP to take control of a IP/TCP session. Although the Non-Blind attack in particular may not be prevented by Source address validation.

When on the same subnet as an attacker, hijacking of a legitimate TCP connection is possible by sniffing the sequence and acknowledgement numbers of the TCP segments. By spoofing the target IP and corrupting the data stream, the session can be re-established by the attacker with the spoofed IP and sniffed the seq and ack numbers, thus hijacking the session. This is known as Non-Blind Spoofing

There is also an attack known as Blind Spoofing that is more sophisticated an only likely to be possible on legacy systems. This attack can be used when the sequence and acknowledgement numbers are unreachable by the attacker. By sampling packets sent to the target an attacker could predict the acknowledgement and sequence numbers, and thus hijack the TCP session. Modern implementations of the TCP protocol however use random sequence number generators making this attack vector unlikely to succeed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.