[shaunol]

How does IP spoofing even work outside of those DNS reflection attacks mentioned on Krebs' blog? [1]

> "many were garbage Web attack methods that require a legitimate connection between the attacking host and the target, including SYN, GET and POST floods."

I constantly see references relating to DDoS attacks about how IP spoofing is such an obvious trick to use but I've never seen any way to actually do it. Why wouldn't every device on the internet spoof their IP?

[1] https://web.archive.org/web/20160922021000/http://krebsonsec...

[Jweb_Guru]

> Why wouldn't every device on the internet just spoof their IP if it was this obvious thing?

https://spoofer.caida.org/summary.php - compromise a device in one of the ASes not marked "unspoofable." Those ASes do not consistently perform packet ingress filtering.

That's not to say that DDOS attacks stop being possible, but at least they become traceable.

[shaunol]

I appreciate the response. I had no idea things were this bad.

[x0]

Thank you, I've actually been interested in the answer to this question for many years! Never was able to solve it via googling.