Are there any products / os that behave differently when an duplicate IP address is detected. This may indicate an IP spoof ?
Can TCP stack 'shutdown' or stop in order to protect itself ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Many switches and routers now have active anti-spoofing, either alerting on duplicates, or entirely blocking IP addresses which are on a port where that address should never be. This is the only sensible use I can think of.
I don't think in any instance it would be a good idea to shutdown of the stack when it discovers its IP address has been spoofed - that would lead to really simple denial of service attacks (the attacker could just increment their IP address through the entire valid range, thus knocking off all devices that do this)
When you say 'protect itself' - as @nealmcb said - against what? An IP spoof is not a direct attack against another network address, in fact usually it is used when trying to pretend to be the valid device, so shutting the real one down would make that much simpler for an attacker as well.