so, my question is:

When a DoS attack occurs and the attacker is using spoofed IP packets, do this packets all carry the same spoofed IP or does every packet have a different IP header?


  • You're assuming every DoS involves spoofing to begin with, which it does not. Clarify what kind of DoS you are talking about.
    – alzee
    Dec 21, 2016 at 21:34
  • Well, I would just like to know, if when a DoS attack occurs, and the attacker is using spoofed IP packets to flood the server, if every packet has a different IP header or if all the headers have the same IP.... Since you can block a specific IP I would guess that every packet has a different IP header?
    – DrDoom
    Dec 21, 2016 at 21:41

2 Answers 2


That depends on why the attacker is spoofing.

If they are spoofing to make it difficult to seperate their traffic from general internet traffic then it makes sense to spoof as randomly as possible.

If they are spoofing to exploit a hole in a firewall (for example a firewall that accepts all packets from addresses internal to a victim) then they would obviously choose addresses from the range they belive the firewall will allow.

If they are spoofing to perform a "reflected" attack then the spoofed source IP will be the IP of the victim.

  • An add up question, not really relevant. How difficult is it to "generate random IP addresses"? I've never used any such tools (like LOIC, HOIC). I would also guess one uses spoofed IP addresses so he can not be traced...
    – DrDoom
    Dec 21, 2016 at 21:46
  • 2
    Trivial, they are just numbers. Dec 21, 2016 at 21:57

The most common use case of IP spoofing is to mislead servers on the internet (for example DNS or NTP servers) to send their answers to a different host than the actual request came from, so then they all use the same spoofed IP address.

This is typically done by creating a small request (for example a DNS lookup) and replacing the source address of the request with the target of the DDoS. The DNS server then sends the reply to the DDoS target instead of the original sender of the request. If the request is large (for example a DNSSEC-signed DNS reply) you can create a large DDoS attack with only limited bandwidth needed at the attacker side (as long as there are enough public services which can be used to do the actual attack).

Of course, this only works for UDP services, since a TCP threeway handshake would fail.

  • So let me see if I get this... you spoof the IP address of the victim, send a UDP request to different servers and let them flood the victim?
    – DrDoom
    Dec 21, 2016 at 21:57
  • Yes, that's correct.
    – Teun Vink
    Dec 21, 2016 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .