IP spoofing forges the source IP information in a packet, making traffic appear to originate from another address. Attackers use it to evade defenses that track and block request sources. section 9.3
Bypassing source-based blocking
A server may track the IP sending repeated requests and blacklist it. Spoofed packets present different origin IPs, making a DDoS attack harder to identify and block. section 9.3
Reduce exposure to spoofed traffic by:
- Hardening managed servers: close unnecessary ports, remove unnecessary services, restrict privileged users, enforce strict firewall rules, and secure remote access. section 9.3
- Using specialized protection against DDoS, port scanning, and other malicious traffic, then evaluating its features and integration. section 9.3
Figure 9.17 IP masking crafts TCP packets with origin IPs different from our own. This technique helps threat actors bypass anti-DoS protection measures that focus on tracking the origin IP of the requests.
Shows how crafted TCP packets use origin IPs different from the sender’s own to bypass anti-DoS controls based on source tracking. section 9.3
