>>13191295
What is Source IP spoofing?
IP address spoofing, or IP spoofing, is the forging of a source IP address field in IP packets with the purposeof concealing the identity of the sender or impersonating another computing system.
Fundamentally, source IP spoofing is possible because Internet global routing is based on the destination IP address. Or, more precisely, an Internet router with a default configuration (i.e. no special policy applied, like reverse path filtering) forwards packets from one interface to another looking up only the destination IP address.
An application with sufficient privileges can modify the source IP address field of an IP packet to any syntactically correct value, and in most cases the packet will be sent through the network interface and in many cases will reach the destination.
Of course, an incorrect source IP address may hinder normal operation of communications: responses from the destination application or intermediary nodes (e.g. ICMP responses) will not reach the sender. But attacks mounted using the spoofing technique do not rely on properly set up communication flows. On the contrary, they abuse this feature, directing traffic flow of responses to the target identified by the forged source IP address.
Botnets.
In order to achieve significant traffic volumes but not attract attention to the real source of the attack, spoofed requests must be generated from many geographically distributed hosts. Botnets are perfect candidates for that. With the average botnet counting tens of thousands of compromised computers and more than 28 million open resolvers, mounting a multi-Gbps attack does not seem like a very difficult task.
https://www.internetsociety.org/wp-content/uploads/2017/08/ISOC-AntiSpoofing-20150909-en-2.pdf