so, my question is:
When a DoS attack occurs and the attacker is using spoofed IP packets, do this packets all carry the same spoofed IP or does every packet have a different IP header?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
That depends on why the attacker is spoofing.
If they are spoofing to make it difficult to seperate their traffic from general internet traffic then it makes sense to spoof as randomly as possible.
If they are spoofing to exploit a hole in a firewall (for example a firewall that accepts all packets from addresses internal to a victim) then they would obviously choose addresses from the range they belive the firewall will allow.
If they are spoofing to perform a "reflected" attack then the spoofed source IP will be the IP of the victim.
The most common use case of IP spoofing is to mislead servers on the internet (for example DNS or NTP servers) to send their answers to a different host than the actual request came from, so then they all use the same spoofed IP address.
This is typically done by creating a small request (for example a DNS lookup) and replacing the source address of the request with the target of the DDoS. The DNS server then sends the reply to the DDoS target instead of the original sender of the request. If the request is large (for example a DNSSEC-signed DNS reply) you can create a large DDoS attack with only limited bandwidth needed at the attacker side (as long as there are enough public services which can be used to do the actual attack).
Of course, this only works for UDP services, since a TCP threeway handshake would fail.