A spoofing attack falsifies a device’s identity, commonly by using a fake source IP address or MAC address. Spoofing can conceal an attacker’s location, redirect responses, exhaust resources, or support interception. section 11.2.1
Common uses and related attacks include:
- SYN flood attacks can spoof the source IP address so SYN-ACK replies do not return to the attacker. section 11.2.1
- DHCP exhaustion, or DHCP starvation, sends countless DHCP DISCOVER messages with spoofed MAC addresses until the server’s address pool is exhausted. section 11.2.1 section 11.6
- Reflection attacks send requests using the target’s spoofed IP address to third-party reflectors, which direct responses at the target; amplification magnifies the effect. section 11.6
- ARP poisoning, also called ARP spoofing, sends malicious ARP replies that alter ARP tables and enable traffic interception. section 11.6
Figure 11.3 A DHCP exhaustion attack. The attacker sends countless DHCP DISCOVER messages with spoofed MAC addresses, exhausting the target DHCP server’s pool. As a result, legitimate user devices cannot receive IP addresses.
Follow the DHCP exhaustion sequence from spoofed MAC addresses to an exhausted address pool and blocked legitimate clients. section 11.2.1
Figure 11.4 A reflection/amplification attack. The attacker sends spoofed requests to third-party servers (reflectors), triggering asymmetrically large responses that are sent to the target, overwhelming it and resulting in a denial of service.
Trace how spoofed requests reach reflectors and produce disproportionately large responses against the target. section 11.2.1
Figure 11.5 An ARP poisoning attack. An attacker sends malicious ARP replies to modify the ARP tables of PC1 and R1, allowing it to intercept their communications.
Inspect how malicious ARP replies modify two devices’ ARP tables and allow communication interception. section 11.2.1
