IP spoofing is when an attacker forges the source IP address in IP packets sent to a computer network to conceal their identity or impersonate another system. It is done by determining the IP address of a trusted system and modifying packet headers to appear to come from that system. Services vulnerable to IP spoofing include RPC, services using IP address authentication, the X Window System, and R services. Types of IP spoofing include blind spoofing, non-blind spoofing, denial of service attacks, and man-in-the-middle attacks. Countermeasures include packet filtering, filtering at routers, and disabling vulnerable commands.

1. Made By:
Dhrumil Shah
TYBBA Div 1
Roll No. 38

2. WHAT IS IP SPOOFING?
In computer networking, IP address spoofing or IP
spoofing is the creation of Internet Protocol (IP)
packets with a forged source IP address, with the
purpose of concealing the identity of the sender or
impersonating another computing system.

3. HOW IS IT DONE?
† In IP spoofing, an attacker gains unauthorized access to
a computer or a network by making it appear that a
malicious message has come from a trusted machine by
“spoofing” the IP address of that machine.
† To be successful, the intruder must first determine the
IP address of a trusted system, and then modify the
packet headers to that it appears that the packets are
coming from the trusted system.

4. SERVICES VULNERABLE TO IP SPOOFING
Configuration and services those are vulnerable to IP
spoofing:
† RPC (Remote procedure call services)
† Any service that uses IP address authentication
† The X Window System
† The R services suite (rlogin, rsh, etc.)

5. TYPES OF IP SPOOFING
† Blind Spoofing
† Non-Blind Spoofing
† Denial of Service attack
† Man in the middle attack

6. WHY IP SPOOFING?
† The sender has some kind of malicious intention and does
not want to be identified.
† You can use the source address in the header of an IP
datagram to trace the sender's location.
† Most systems keep logs of Internet activity, so if
attackers want to hide their identity, they need to
change the source address.
† The host receiving the spoofed packet responds to the
spoofed address, so the attacker receives no reply back
from the victim host.

7. COUNTER MEASURES
† Packet filtering
† Limits of packet filtering
† Filtering at the router
† Disable commands