I know just enough about TCP to know there's a header which, among other things, contains the origin IP and target IP of that packet, which the internet uses to guide it to its destination and then on its return journey (the response).

If I wanted to make an illegal online transaction, could I write the origin IP header to point to some other person's computer, perhaps one I've compromised, then gather the data from that computer later and delete the traces, leading any investigators to the wrong PC and a dead end (once they try to prosecute the wrong person and realize they were tricked)?

This seems like an interesting and simple alternative to running the packets through a series of proxy servers and encrypting the TCP headers via a network such as Tor (which the FBI has allegedly developed a way to compromise). Is this a common / well-known strategy? If so, what are the flaws?

  • To clarify: the TCP header is IP address agnostic; it doesn't know anything about addressing nor does it care. This is handled by IP at the network later. So if you are talking about address spoofing, that is something at the network layer, not the transport layer. Apr 28, 2016 at 17:11

2 Answers 2


While this is a good idea in theory it can not work practically.
The TCP protocol uses a three-way-handshake, and so when you spoof the origin IP in a packet the packet with the SYN flag (First packet) will be sent but when the destination machine tries to establish a connection by sending an SYN-ACK packet back to that spoofed IP, the connection will fall since the spoofed machine will deny sending the first packet.

P.s: Some routers will not allow the sending of a packet not from the routers IP and drop it already by them and may even notify the ISP...

  • Some routers block spoofed addresses - but not many
    – paj28
    Apr 28, 2016 at 12:48
  • I know. That is exactly why I wrote "some". Apr 28, 2016 at 12:54
  • Got ya! Nice answer, and welcome to the site :)
    – paj28
    Apr 28, 2016 at 19:12

Let's assume you just ask out of curiosity and we are not helping you committing a crime.

So why would you want to modify the TCP Header and redirect packets to another host? I am not sure if that could work at all but if you had a compromised computer, why don't you do whatever you have in mind from there?

Also if the compromised computer is offline it won't receive the packets at all but you won't know until you go and check.

If you ask just for the general feasibility, maybe someone esle can give you a definite answer.

  • 3
    On this site, you can always assume an understanding is wanted for the sake of preventing a crime, or purely for knowledge. Often the best way is to imagine you're the bad guys.
    – J.Todd
    Apr 28, 2016 at 12:15
  • 1
    I am new to this very site but I am aware of what you say. My introducing line should be more of a joke. But thank you for clarifying. ;)
    – Thorian93
    Apr 28, 2016 at 12:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .