so, my question is:

When a DoS attack occurs and the attacker is using spoofed IP packets, do this packets all carry the same spoofed IP or does every packet have a different IP header?

Thanks

  • You're assuming every DoS involves spoofing to begin with, which it does not. Clarify what kind of DoS you are talking about. – alzee Dec 21 '16 at 21:34
  • Well, I would just like to know, if when a DoS attack occurs, and the attacker is using spoofed IP packets to flood the server, if every packet has a different IP header or if all the headers have the same IP.... Since you can block a specific IP I would guess that every packet has a different IP header? – DrDoom Dec 21 '16 at 21:41
up vote 2 down vote accepted

That depends on why the attacker is spoofing.

If they are spoofing to make it difficult to seperate their traffic from general internet traffic then it makes sense to spoof as randomly as possible.

If they are spoofing to exploit a hole in a firewall (for example a firewall that accepts all packets from addresses internal to a victim) then they would obviously choose addresses from the range they belive the firewall will allow.

If they are spoofing to perform a "reflected" attack then the spoofed source IP will be the IP of the victim.

  • An add up question, not really relevant. How difficult is it to "generate random IP addresses"? I've never used any such tools (like LOIC, HOIC). I would also guess one uses spoofed IP addresses so he can not be traced... – DrDoom Dec 21 '16 at 21:46
  • 2
    Trivial, they are just numbers. – Peter Green Dec 21 '16 at 21:57

The most common use case of IP spoofing is to mislead servers on the internet (for example DNS or NTP servers) to send their answers to a different host than the actual request came from, so then they all use the same spoofed IP address.

This is typically done by creating a small request (for example a DNS lookup) and replacing the source address of the request with the target of the DDoS. The DNS server then sends the reply to the DDoS target instead of the original sender of the request. If the request is large (for example a DNSSEC-signed DNS reply) you can create a large DDoS attack with only limited bandwidth needed at the attacker side (as long as there are enough public services which can be used to do the actual attack).

Of course, this only works for UDP services, since a TCP threeway handshake would fail.

  • So let me see if I get this... you spoof the IP address of the victim, send a UDP request to different servers and let them flood the victim? – DrDoom Dec 21 '16 at 21:57
  • Yes, that's correct. – Teun Vink Dec 21 '16 at 21:58

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.