I know it is not possible to perform a successful TCP Handshake with a spoofed IP-Address.

However I wonder: Is it possible to spoof the IP once a TCP handshake was performed successfully?

For example:

  1. Perform the handshake

  2. Use the session (with a different IP) and send a request

  3. The response is delivered to the spoofed IP

Thanks in advance!

2 Answers 2


Is it possible to spoof the IP once a TCP handshake was performed successfully?


A TCP session is defined by four items:

  • Source IP address
  • Source IP port
  • Destination IP address
  • Destination port

This comes from RFC 793:

To provide for unique addresses within each TCP, we concatenate an internet address identifying the TCP with a port identifier to create a socket which will be unique throughout all networks connected together.

A connection is fully specified by the pair of sockets at the ends.

If you were to:

  1. Use the session (with a different IP) and send a request

When you change any one of those four parameters, like the source IP, the new packet is no longer a part of that TCP session, and will not be "delivered" because it does not match the session definition. Instead, it'll be an out-of-state packet, and dropped or rejected.

  • 3
    That answer is incomplete: you also have the TCP sequence number of the packet to take into account.
    – Stephane
    Commented Aug 31, 2015 at 12:22
  • 5
    @Stephane the TCP sequence number is required to order packets within a connection, but it is not part of what defines the session. Yes, you must guess the TCP sequence number in order to spoof a packet when the four session definition parameters are the same. But by itself it changes all the time, and is not part of what defines the session for either endpoint. (Put differently, mucking with the sequence number can create an invalid packet with otherwise valid session parameters, which is separate from OP's question about creating a valid session with an invalid IP address parameter.)
    – gowenfawr
    Commented Aug 31, 2015 at 12:25

As explained by the answer of gowenfawr you can not change the IP of a TCP session. However there are some options to have a TCP connection while spoofing the source IP.

All that IP-spoofing does is change the Source IP address of the packet you send. This is done on the routing (IP) layer of the network stack. The server will threat this spoofed packet as it would any packet, be it some packet of the handshake or some packet thereafter. It will reply to the source IP address, which when you spoofed it is likely not "owned" by you and thus you will not receive the response.

So how could you still receive a packet that is not addressed to you? A few options come to mind:

  • You are on an unprotected (or breached protection) wireless network and the addressee is located on this network as well. The addressee will ignore the packet but if you are listening to all packets on the network you will see the packet and thus be able to reply appropriately or use the replied information.

  • You have access to the addressee's machine, in this case you might as well send the packet from here instead of spoofing it.

  • You have access to some router along the path the packet will take, this would allow you to make the router send a duplicate to you. But it is not trivial to know which way a packet will travel.

Though theoretically possible changing the routing of the packet itself to make it be send to you is unfeasible in my opinion.

So the short answer is you will never be able to receive the reply of a IP-spoofed packet without some extra measures.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .