Hypothetically speaking - if my web server gets an http request for a given file, say default.html, and let's say the requesting IP address has been spoofed, what happens when my server responds to the request? Would it send the file to the (fake) IP address? Would the outbound data be dropped somewhere along the way? Would my server get any feedback that the destination IP doesn't want the data or there never really was any open connection to the destination IP?
To extend this a little further, let's say the file is really large, say 5 or 50 mb. If my server reports (in the logs) that the number of bytes transferred to the requesting IP is indeed 5 or 50 mb, and that the transfer happened without error, then can I conclude that the requesting IP wasn't spoofed and it was legit?
I will note that some (or most) aspects of my question seem to have been addressed in this thread:
But there seems to be conflicting information in that thread. Some people say no, you can't spoof an http request, while others say "If you can fit the request in a single TCP packet, you can."
The last comment in that thread says flat-out, "It's possible to spoof the destination IP, so when the server sends the TCP/IP payload, it goes to the SPOOF IP, and not your computer".
So it's not clear to me if the spoofed IP address would be exposed to any traffic (or at minimum a syn-ack response) as a result of the fake/spoofed http request to my server. And again, if my server logs indicate that 100% of the requested file was transferred without error, even if were a large file - could that happen only if the requesting IP was legit (not spoofed)?
The proposed answer (Is it possible to pass TCP handshake with spoofed IP address?) answers the question with both a yes and a no. Specifically, here is the part of that answer that seems to say "yes it can be done, for a short transaction at least":
Unless source routing or access to a router in the network path is available, this is not a sustainable setup. The client may be able to guess the ISN, but later sequence numbers are incremented by the size of the packets being sent, which the attacker won't see and can't reliably predict. So they should be able to get at least one packet in after the three-way handshake, but not a conversation. And sometimes one packet is enough.
I just want to know if it's possible that my server would answer the http request to a spoofed IP by sending the requested file and logging the request has having been performed with no errors. Under the conditions that none of my network gear (modem, router, etc) is compromised and the requested file is small (under 10kb) and there are no further requests or transactions as part of the session. If the answer is probabilistic (ie - it can happen but there is some chance element to it) then I will go further and ask if there is a way it can happen every time it is attempted (but with the spoofed IP changing between attempts).