In a situation, where the spoofed IP is a real existing remote IP and it is found that the TCP 3-way handshake has been made with a server.
The MiTM machine sends the packet with spoofed IP to the server. Does the real IP acknowledge the ACK sent back from the server to real IP and receive the response packet from the server followed by the acknowledgement?
EDIT: As the brief above was not clear, here I try to be as descriptive as possible.
Client A with real IP has connected with server S completing the TCP 3-way handshake and transferring data packets like a regular connection. Now, the attacker machine M sends a packet spoofing the IP address of A and once this packet is received by the server, it sends back the ACK flag/field to A. Please correct me if I am wrong with this part of ACK flag/field here.
Now my questions here are:
- Will the ACK flag/field from server S be accepted by A?
- The packet sent by M with spoofed IP of A gets a response from S to A. Will this response be accepted by A?