How IP Address Spoofing or Masquerading Works

IP address spoofing is a technique in which a node transmits data packets using an unauthorized IP address. The sender conceals its true IP address by substituting it with another, often selecting an address from within the destination network. This practice is also referred to as masquerading.

The basic concept of address spoofing

An IP address uniquely identifies a computer on a network. Computers rely on IP addresses to communicate and exchange data. When transmitting large volumes of data, a computer divides the data stream into smaller packets and sends each packet individually.

Each data packet includes a source address, which identifies the sender, and a destination address, which identifies the recipient. Upon receiving a packet, the recipient uses the source address to determine the sender and replies to that address. Because the recipient uses the source address to send replies, an attacker can falsify the source address to redirect responses to another system. This method is known as IP address spoofing or masquerading.

The following example illustrates this process.

Albert sends a letter to Nina. However, he uses Peter's name and address as the sender. Nina will believe the letter is from Peter and send her reply to him. This scenario demonstrates the concept of address spoofing.

How does an IP address spoofing attack work?

IP address spoofing operates in a manner analogous to address spoofing. In such an attack, a node inserts a false IP address into the source address field of a packet. The destination device then replies to this falsified address. Typically, the attacker is not interested in receiving the response, but rather in manipulating the recipient's behavior.

The following example demonstrates the mechanics of an IP address spoofing attack.

Consider a network that uses the 1.0.0.0/8 address space for internal IP addresses, with a server assigned the address 1.1.1.1. The server is configured to respond only to requests originating from within the internal network. An attacker connects to the network and transmits thousands of packets per second to the server, using the correct destination address but falsifying the source address to appear as if it originates from within the internal network. The server, believing the packets are legitimate, replies to each one.

The following image shows this example.

In this example, the attacker's actual IP address is 10.0.0.5, but the source address field in each packet is set to 1.1.1.2. Upon receiving these packets, the server assumes they originate from a trusted internal host and replies accordingly. The legitimate host at 1.1.1.2, having made no such request, disregards the unsolicited replies. This approach enables the attacker to target both the server and the internal host.

This technique is frequently used in Denial-of-Service (DoS) attacks, in which an attacker overwhelms a service with fraudulent requests, rendering it unable to respond to legitimate traffic.

How to mitigate an IP address spoofing attack

To mitigate IP address spoofing attacks, you can implement a firewall at the point where external traffic enters the network and configure ingress filtering. Ingress filtering allows you to filter all incoming traffic. Since no internal host is available on the other side of this point, you can create rules that deny incoming packets with an internal IP address in the source address field.

The following image shows how ingress filtering protects the network from IP address spoofing attacks.

You can also configure the firewall to filter outgoing traffic by creating rules that deny packets with a source address that lacks a valid internal IP address. This process is known as egress filtering. It prevents internal hosts from initiating IP address spoofing attacks against external systems.

The following image shows how egress filtering prevents unauthorized traffic from leaving the internal network.

Conclusion

IP address spoofing is a deceptive method employed by attackers to conceal their identity, gain unauthorized access, or disrupt network operations. Understanding spoofing techniques and the options to prevent them are critical for safeguarding networks against threats associated with IP address masquerading.