What is IP Address Spoofing?

IP address spoofing means that the IP packets generated by the action are forged source IP addresses in order to impersonate the identity of other systems or senders. This is a form of hacker's attack. A hacker uses one computer to surf the Internet and borrows the IP address of another machine, thus impersonating another machine to deal with the server.

IP address spoofing means that the IP packets generated by the action are forged source IP addresses in order to impersonate the identity of other systems or senders. This is a form of hacker's attack. A hacker uses one computer to surf the Internet and borrows the IP address of another machine, thus impersonating another machine to deal with the server.

Chinese name

IP address spoofing

Foreign name

IPaddress spoofing

Alias

IP spoofing attack

IP address spoofing definition

Refers to the IP packets generated by the operation as forged source IP addresses in order to impersonate the identity of other systems or senders. This is a form of hacker attack. A hacker uses one computer to surf the Internet and borrows the IP address of another machine, thus impersonating another machine to deal with the server. The firewall can recognize this kind of IP spoofing.

According to the Internet Protocol (IP) network interconnection protocol, the packet header contains source and destination information. IP address spoofing is to forge the header of a packet so that the source of the displayed information is not the actual source, as if the packet was sent from another computer.

IP address spoofing attack diagram

IP addresses spoof vulnerable services

• IP address authentication as a service for user identity

• X window system

• Remote service series (such as remote access service)

IP address spoofing application method

In the field of network security, one way to hide yourself is IP spoofingspoofing its own IP address to send malicious requests to the target system, causing the target system to be attacked but unable to confirm the source of the attack, or obtaining the trust of the target system in order to obtain confidential information.

These two goals correspond to two scenarios:

Scenario 1: Commonly used in DDoS attacks (distributed denial of attack). In a malicious attack request to the target system, a large number of fake source IPs are randomly generated. If the target defense is weak, the source of the malicious request cannot be analyzed. Authenticity, so as to achieve the purpose of the attacker to hide himself.

An interesting special scenario in this type of scenario comes from a "reflective" DDoS attack, which is characterized by the use of a protocol defect in a service of the target system, and the asymmetry of the input and output of the target system-towards the target. Initiate a malicious request with a relatively low throughput, and then the target system returns a large number of responses due to its protocol defects, blocking network bandwidth and occupying host system resources. At this time, if the attacker's request uses the real source address, it will be swallowed by a huge response and hurt himself. In this way, it is imperative for attackers to take IP spoofing measures.

Scenario 2: Host A originally trusts Host B, which means that B can obtain A's data resources unobstructed. In order for malicious host C to obtain A's data as well, it needs to pretend to be B to communicate with A. In this way, C needs to do two things: first, let B "plug his mouth" and stop sending requests to A, such as launching a DoS attack (denial of service attack) on B host, occupying B's connection and preventing him from sending out the network normally Packet; second, IP disguised as B interacts with A.

IP address spoofing defense method

The prevention of IP spoofing requires that the target device adopt stronger authentication measures, not only trust the visitor based on the source IP, but also require strong passwords and other authentication methods; on the other hand, adopt a robust interaction protocol to improve the source of spoofing. The threshold of IP.

Some high-level protocols have unique defense methods. For example, TCP (Transmission Control Protocol) guarantees that data packets come from established connections by replying to sequence numbers. Because the attacker usually does not receive the reply message, the serial number cannot be known. However, the TCP sequence numbers of some older machines and systems can be detected.