What is IP spoofing, and how does it work?

IP spoofing is used to trigger a cyberattack by impersonating a trusted device or IP address. Attackers change the source IP address to hide their identity or make the traffic look like it came from another device.

One of the simplest examples is a DDoS attack. Imagine that, using fake source IP addresses, hackers send large amounts of traffic within a company's network. When there are hundreds or thousands of these requests, the company can't block them without knowing exactly which requests are coming from legitimate users. This is how these requests can disrupt the entire network's operation.

In this article, I explain how IP spoofing works, the kinds of damage it can cause, how to recognize it, and how to protect yourself from attacks that use it.

What is IP spoofing?

IP spoofing is basically faking the return address on a letter. Every IP packet has an address that tells the receiving system where the packet supposedly came from. With spoofing, an attacker changes this address so the packet appears to come from another device or network.

For example, an attacker may send a packet from their own computer, but put 192.0.2.1 in the source IP field. The packet still came from the attacker. Changing the address doesn’t give them access to or control over 192.0.2.1. It only changes what the receiver sees as the packet’s source.

This can be useful in attacks such as DDoS, particularly reflection attacks. An attacker can make a request appear to come from the victim's IP address. A third-party server then sends its response to the victim instead of the attacker. If this happens on a large scale, the resulting traffic can overwhelm the victim's network or service.

How does IP spoofing work?

IP spoofing works by changing the source IP address in a network packet so it looks like the packet came from another device or network.

Here is how the process works:

1. A device creates a packet with a source and destination IP address
2. The sender changes the source IP address to a different one
3. The packet is sent to its destination
4. The receiving network checks the packet and decides whether to accept or block it

Not all spoofed packets will reach their destination. Networks can use security measures such as source-address validation to detect and block packets with suspicious or incorrect source addresses.

The important thing to remember is that changing an IP address doesn't give someone access to that IP or the device using it. It only changes what the packet says about where it came from.

What is IP spoofing used for?

IP spoofing can be used for both legitimate purposes and cyberattacks. The most common uses include:

• DDoS attacks. Attackers can use fake IP addresses to make large amounts of malicious traffic harder to filter and identify. A good example is the Mēris botnet case, where a massive DDos attack targeted online services.
• Reflection attacks. Attackers can put the victim's IP address in requests sent to other servers, causing those servers to send their responses to the victim.
• Bypassing IP-based restrictions. Attackers may spoof a trusted IP address to try to get around network rules that rely only on IP addresses.
• Load testing. Engineers generate large amounts of traffic to see whether a server or network can handle it.
• Security testing. Security teams may simulate spoofed traffic to check whether network defenses can detect and block it.

How do you detect and prevent IP spoofing?

To prevent or mitigate attacks, block packets with impossible or suspicious source addresses through ingress filtering. Use firewalls and traffic filtering to stop suspicious traffic, and rely on authentication and cryptographic protocols so that an IP address is not the only proof of identity. DDoS protection and rate limiting can also help reduce the impact of an attack. Here’s what this all means in more detail:

• Ingress filtering. Networks check incoming packets to see whether their source IP addresses make sense. For example, if a packet arrives from the internet claiming to come from an IP address that belongs to the organization's internal network, it can be flagged or blocked. This helps stop spoofed packets before they enter the network.
• Traffic monitoring. Administrators can look for unusual traffic patterns, such as large numbers of packets from suspicious or unexpected IP addresses. They can also compare the source IP with other network information to identify inconsistencies.
• Cryptographic authentication. Some protocols use encryption and digital authentication to verify that a message really came from an authorized source. This provides stronger proof of identity than an IP address alone, because an IP address can be forged, while cryptographic credentials are much harder to fake.
• Filtering and rate limiting. Suspicious traffic can be blocked or limited before it overwhelms a server or network.

Does a VPN prevent IP spoofing?

No, a VPN doesn’t prevent IP spoofing. It changes the public IP address websites see. A VPN can help you prevent DDoS attacks as it changes your IP and encrypts traffic between your device and the VPN server. However, it can’t stop an attacker elsewhere from forging packet source addresses.

A reliable VPN can reduce some related risks, for example, on public (untrusted) Wi-Fi, by encrypting your connection to the VPN server and hiding your home IP address from destination sites.

How does IPsec protect against spoofing?

IPsec protects against spoofing by replacing blind trust in source IP addresses with cryptographic proof of identity and integrity.

• Security Associations (SAs). Before any traffic flows, the two endpoints negotiate an SA, which is essentially a private agreement on which keys and encryption algorithms they will use to verify each other.
• Data-origin authentication. Each protected packet carries a cryptographic tag (a Message Authentication Code, or MAC/ICV) computed with the SA’s secret key. The receiver recomputes this tag; if it doesn’t match, the packet is discarded. This proves the sender knows the secret, not just the IP address.
• Integrity checks. The same MAC also guarantees the packet wasn’t altered in transit. Changing even a single bit breaks the check, so an attacker can’t “fix” a spoofed packet to look valid.
• Anti-replay protection. Sequence numbers in AH/ESP let the receiver detect and drop old or duplicated packets, preventing replay-based spoofing.

Because legitimacy depends on passing these cryptographic checks tied to the SA – not on the visible IP address – simply forging a source IP isn’t enough. An attacker would also need the SA’s secret key and the ability to produce valid MACs and sequence numbers, which is computationally infeasible without compromising the endpoints.

Is IP spoofing illegal?

IP spoofing itself is a technical method rather than a specific type of activity. Whether using it is lawful depends on what you do with it, where you do it, and whether you have authorization.

Testing spoofing against your own lab or systems with explicit permission is different from sending forged traffic toward third-party systems.

The bottom line

IP spoofing works by rewriting the source IP address in a packet so the traffic looks like it’s coming from somewhere else. This technique has legitimate uses in network testing and troubleshooting, but it’s also used in attacks such as spoofed-source denial-of-service and reflection/amplification attacks.

Because a source IP address is not proof of identity, administrators should not rely on it for trust decisions. Practical defenses include ingress and egress filtering to block packets with impossible or unauthorized source addresses, source-address validation at the network edge, continuous monitoring and logging to spot anomalies, and application or transport-layer authentication where identity matters.

VPNs and IPsec tackle related but distinct problems. A VPN encrypts your traffic and can change the public-facing address seen on the internet, while IPsec can add cryptographic integrity and data-origin authentication to IP packets. Used together with network-level filtering, these tools make it much harder for forged traffic to be accepted as legitimate.