IP address spoofing
lastmod 2020-11-20created 2020-11-202 edits
In computer networking, IP address spoofing or IP spoofing is the creation of Internet Protocol (IP) packets with a false source IP address, for the purpose of impersonating another computing system.
Background
The basic protocol for sending data over the Internet network and many other computer networks is the Internet Protocol (IP). The protocol specifies that each IP packet must have a header that contains the IP address of the sender of the packet. The source IP address is normally the address the packet was sent from, but the sender's address in the header can be altered, so to the recipient the packet can appear to come from another source.
The protocol requires the receiving computer to send back a response to the source IP address, so spoofing is mainly used when the sender can anticipate the network response or does not care about the response.
The source IP address provides only limited information about the sender. It may provide general information on the region or city when the packet was sent. It does not provide information about the identity of the sender or the computer being used.
Services vulnerable to IP spoofing
Configurations and services that are vulnerable to IP spoofing:
- RPC (Remote Procedure Call services)
- Any service that uses IP address authentication
- The X Window System
- The R services suite (Rlogin, rsh, etc.)
See also
- IP
- InformationSecurity:CheckList:Unix - Checklist of security items for Unix-like systems.