There is a network that is protected with a firewall and only one IP is whitelisted.

Assuming the attacker knows the whitelisted IP, what would prevent an attacker from sending traffic via a spoofed IP to access the network?

  • 1
    The attacker would not be able to any traffic back, which makes things a bit more difficult... But, yes, spoofing of source IP is a well-known type of malicious activity. – hft Jul 28 '18 at 0:00

I'm not entirely sure what you're asking.

If you're asking, "are there other controls that a defender can use to prevent inbound connections from spoofed IPs?", then yes; TTLs or other metadata of the traffic is one possible avenue, for example. Even the data content could be used(i.e. blocking unexpected data/formats).

If you're asking, "is there anything inherent in how networks work that would prevent this?", then no; spoofing a source IP doesn't affect delivery(unless you use a bogon/martian and happen to get it dropped by an intermediary system).

You won't get any data back from the attacked machine, and you will have a very hard time if you're using a protocol like TCP, where it wants to establish a connection via a handshake... but it's certainly possible.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.