# How does IP spoofing work and how can you stop it?

> IP spoofing works by forging a packet's source address. Learn how ingress filtering, source validation, and authentication reduce its impact.

IP spoofing works when a sender places a forged source IP address in an IP packet, making the packet appear to come from another system. It is most useful where a target accepts traffic without proving the sender controls that address, or where attackers want replies sent to a victim. Stop it by filtering invalid source addresses at network boundaries and by requiring cryptographic or stateful authentication where identity matters.

## Quick takeaways

- IP spoofing changes the source-address field in an IP packet. It does not give an attacker control of the forged address.
- A spoofed source address can make reply traffic go to an unrelated host.
- Ingress filtering drops traffic whose source address should not arrive on a given interface.
- Egress filtering helps prevent networks from sending packets with source addresses they do not own.
- TCP's return traffic makes blind source-address spoofing harder for connections that require a completed handshake.
- Email domain spoofing is a separate problem. SPF, DKIM, and DMARC validate authorized use of an email domain, not the network origin of every IP packet.

## How IP spoofing works

An IP packet includes a source address and a destination address. The source address tells the receiving system where return traffic should go, but IP itself does not authenticate that field. [RFC 2827 describes the risk of packets with forged source addresses](https://datatracker.ietf.org/doc/html/rfc2827): an attacker can send traffic that claims to originate from an address assigned to another network.

Consider a packet sent to `198.51.100.20` with a source address forged as `203.0.113.44`. The target may send any response to `203.0.113.44`, not to the attacker. That behavior supports reflection attacks, where a third-party service sends traffic toward the spoofed victim address.

Source-address spoofing is different from taking over an IP address. The attacker can choose a value for the packet header, but they normally cannot receive responses routed to an address they do not control. This limits attacks against protocols that need a two-way exchange. TCP, for example, uses a handshake and sequence numbers, so a remote attacker who cannot observe the replies has difficulty completing a normal TCP connection.

The problem changes for protocols that answer an unauthenticated request, especially UDP-based services. A forged request can cause a service to send its response to the victim. The Internet Engineering Task Force documents source-address validation as a way to reduce this class of abuse in [RFC 8704](https://datatracker.ietf.org/doc/html/rfc8704).

![Flow showing a forged-source packet, a target service, and the response sent to the victim address](/images/editorial/how-does-ip-spoofing-work-and-how-can-you-stop-it/how-does-ip-spoofing-work-and-how-can-you-stop-it-spoofing-flow.webp "1200x676")

*Source: Palisade.*

## When IP spoofing matters, and when it does not

Use this decision rule: treat a source IP address as a routing clue unless the protocol or network control independently validates it.

IP spoofing is a material concern when:

- A public-facing service responds to requests without confirming the requester controls the source address.
- A router accepts packets from outside the network that claim to originate from internal or private address ranges.
- An organization allows outbound traffic with source addresses that its network has not assigned.
- An application grants trust solely because a request appears to come from a particular IP address.

It is less effective when the target requires a completed exchange that the attacker cannot observe, or when the network rejects packets whose source addresses fail route-based validation. Those controls reduce risk, but they do not make an IP address proof of a user's identity.

Do not confuse IP spoofing with email spoofing. A fraudulent message can use a visible From address that resembles a trusted domain even if its sending infrastructure uses a valid IP address. [Email authentication](/learning) addresses that separate identity problem through SPF, DKIM, and DMARC. For a broader explanation of deceptive identity techniques, see [what exactly spoofing is and how to stop it](/learning/what-exactly-is-spoofing-and-how-can-you-stop-it).

## Worked example: identify traffic that should be dropped

A perimeter router should reject a packet arriving from the public internet when its claimed source address belongs to the organization's own internal range. It should also reject source ranges that are not valid on that interface under the organization's routing design.

```text
Illustrative inbound packet

Source IP: 10.20.30.40
Destination IP: 198.51.100.20
Ingress interface: public-internet

Decision: drop
Reason: 10.20.30.40 is an internal private address and must not arrive from
the public-internet interface.
```

The exact prefixes and interfaces depend on your network design. Do not copy example ranges into a production access-control list without reviewing routing, remote-access paths, cloud connectivity, and legitimate asymmetric traffic.

[RFC 3704 defines ingress filtering](https://datatracker.ietf.org/doc/html/rfc3704) as filtering based on the expected relationship between a packet's source address and the interface where it arrives. Strict reverse-path checks can drop valid traffic in networks with asymmetric routing, so operators need to choose a method that fits the actual return paths.

A useful evidence set includes:

- The packet capture or flow record showing source address, destination address, protocol, ports, and ingress interface.
- The route or prefix assignment that shows whether the claimed source is valid on that interface.
- Firewall or router logs showing whether a source-validation rule accepted or dropped the packet.
- For an application-level incident, logs that show whether the service authenticated the requester beyond its IP address.

## What to do next

Start at the network edge. Review inbound rules for traffic that claims to originate from your own address space, private-use ranges, loopback ranges, or prefixes that are invalid for the interface. Then review outbound rules so hosts cannot send packets with source addresses outside the prefixes your network owns or delegates.

For services where the caller's identity affects authorization, require an authentication mechanism that the source IP address cannot provide on its own. The appropriate control depends on the protocol, such as mutual TLS, signed requests, or an authenticated session. Test the real request path after each change. A configuration review alone does not prove that every ingress path applies the rule.

If the concern is a message that impersonates your organization, inspect the domain rather than the packet source. [How to stop spoofing attacks](/learning/what-exactly-is-spoofing-and-how-can-you-stop-it) covers domain-focused defenses, while [how malspam works and how to stop it](/learning/how-does-malspam-work-and-how-to-stop-it) covers malicious email campaigns.

### Check the domain controls behind suspected email spoofing

If recipients are receiving messages that use your domain in the visible From field, check the domain's published DMARC record before changing email policy. The record shows the public policy and reporting destination your domain currently publishes.

[Check the DMARC record](/tools/dmarc)

A public DNS check cannot prove where one message originated, whether a receiver accepted it, or whether every production sender passes DMARC alignment.

For an ongoing DMARC rollout, Palisade is AI-first, agent-first DMARC software that analyzes aggregate-report data, identifies sending sources and authentication or alignment issues, and creates prioritized remediation tickets. It can propose the next policy step when the evidence supports it, while your team reviews the evidence and applies the DNS change.

[Start with Palisade](https://app.palisade.email/signup?utm_source=palisade_learning&utm_medium=article&utm_campaign=existing-content-migration&utm_content=how-does-ip-spoofing-work-and-how-can-you-stop-it)

Palisade does not block spoofed network packets, change a DMARC policy without human review, or guarantee a receiver's delivery decision.

## Sources and further reading

- [RFC 2827: Network ingress filtering](https://datatracker.ietf.org/doc/html/rfc2827)
- [RFC 3704: Ingress filtering for multihomed networks](https://datatracker.ietf.org/doc/html/rfc3704)
- [RFC 8704: Requirements for unicast source-address validation](https://datatracker.ietf.org/doc/html/rfc8704)
- [Palisade DMARC checker](/tools/dmarc)

## Frequently asked questions

### Can an attacker receive replies sent to a spoofed IP address?

No. Replies route to the forged address, so an attacker who does not control or observe that address cannot normally receive them. That is one reason spoofing is more useful for one-way traffic and reflection attacks than for ordinary TCP sessions.

### Does a firewall stop all IP spoofing?

No. A firewall can enforce anti-spoofing rules at the paths it controls, but source validation must cover relevant ingress and egress paths. Application authentication is still needed when access decisions require a reliable identity.

### Is IP spoofing the same as email spoofing?

No. IP spoofing forges a packet's source IP address. Email spoofing impersonates an email identity, often the visible From domain. SPF, DKIM, and DMARC help receivers evaluate whether the email domain use is authorized.

### Can reverse-path filtering break legitimate traffic?

Yes. Strict reverse-path filtering can reject valid packets when the return route differs from the incoming route. RFC 3704 describes multiple filtering approaches, so the chosen method should match the network's routing design.

### Does DMARC stop IP spoofing attacks?

No. DMARC applies to email authentication and the visible From domain. It does not validate arbitrary IP packets or replace router ingress and egress filtering.