What Is IP Spoofing? How Fake Addresses Are Used and Stopped

Every packet on the internet carries a source address — a return label saying who sent it. IP spoofing is writing a false one. It's a real technique with real abuse, but it's also widely misunderstood: spoofing lets an attacker lie about where packets come from, not read your data or take over your address.

How spoofing works — and its built-in limit

Crafting a packet with any source address you like requires only low-level network access. The catch: replies go to the forged address, not to the attacker. Spoof a request as coming from 203.0.113.7 and the answer is delivered to the real 203.0.113.7. That single fact shapes everything spoofing is and isn't used for — you can't browse, log in, or hold a conversation over a spoofed connection, because you never receive the responses.

What attackers actually use it for

• DDoS floods — attack packets with randomised fake sources are harder to filter and hide the true origin. See how DDoS attacks work.
• Reflection/amplification — the nastiest trick: send small queries to public servers with the source forged as the victim's IP. The servers dutifully send large replies to the victim, multiplying the attacker's bandwidth many times over.
• Trust abuse in legacy systems — old protocols that authenticated by source IP alone could be fooled; modern systems authenticate cryptographically for exactly this reason.

What spoofing can NOT do

• Impersonate your IP to browse or commit crimes "as you" in any interactive sense — no replies, no session
• Intercept your traffic or read your data
• Defeat TCP connections against modern stacks — the three-way handshake requires receiving a response with an unguessable sequence number
• Change what websites see when you visit them — your real connection uses your real address (check it here); hiding it requires rerouting, not forging

The internet's defences

Egress filtering (BCP 38) asks every network to drop outgoing packets whose source addresses don't belong to it — spoofing dies at the first router when providers do this. Adoption is broad but incomplete, which is why reflection attacks persist. Meanwhile ingress filtering, TCP's handshake design, and cryptographic authentication (TLS, VPN tunnels) make spoofing useless against everyday secured traffic.

For ordinary users the takeaway is calm: spoofing is an infrastructure-level nuisance aimed at servers, not a way anyone can "become" your IP address or frame your connection interactively.

Frequently asked questions