This question already has an answer here:
Let's say that I'm a malicious user Bob and I have found a vulnerability in an application that will allow me to impersonate another user, Alice. Alice is connected to 'X' server with her IP address (220.127.116.11) and local port (1234).
Through some means, I have managed to obtain both Alice's IP address and the local socket she is connected through (18.104.22.168:1234). Given this information, how feasible is it to construct a spoofed UDP packet and have it be successfully routed to server 'X', without it being dropped?