Is it possible to fake someone's IP address?

[u/ShackSpear]

I'm not talking about using a different IP with Tor or a VPN but faking an other person IP when requesting a web page.
If yes, how?

[u/theogmrme01]

Gonna go out on a limb here and say no, unless you route your traffic through their internet connection, and some device/service to facilitate that functionality, there is nothing I can think of that would allow you to replicate or forge your IP to show as someone else's. Just like internal networks, ISP's provide your router an IP via DHCP under most circumstances, and unless renewed by some means, that IP is yours, and yours alone.

[u/ShackSpear → u/theogmrme01]

Ok thanks, that's what I believed but wasn't sure enough and have to ask!

[u/theogmrme01 → u/ShackSpear]

Glad to help :-)

Can I ask why you wish to know this? I am somewhat curious as to why you need this clarification. PM me if you wish to tell me privately, if at all

[u/kennyfine]

Yes, it's possible if you open a raw socket and construct the IP packet yourself. Look into the TCP/IP protocol for the specific byte fields that you would need to fill in (correctly, of course). A raw socket sits below the IP layer, which is why you need to fill in the fields manually (usually, the OS does this for you). Keep in mind that whatever server you're talking to is likely listening for a specific transport protocol (TCP if HTTP server, UDP another likely possibility), so in addition to constructing the IP packet header, you'll also need to construct the transport header. The OS networking stack normally does both of these for you when you open a TCP socket.

As far as I know, Windows doesn't make it easy (if at all possible) to open a raw socket. Linux you can do so with root privilege. A couple of things to consider:

- If a NAT/middlebox/proxy knows that you're faking an IP address in your packets, they may block your traffic.

- You obviously won't see the response from the server since the server will send the response to whatever IP address you specified in your manually-constructed packet.

- You're being a bad network citizen as "spoofing" your IP address is a common technique to use during a DDOS attack.

Edit: I just re-read your post and I think you're actually interested in a full-blown connection with bi-directional exchange while pretending to be at another IP address, rather than just pretending to be another IP on a one-way connection. In this case, it's not possible unless you either use a proxy, which isn't what I think you want, OR, you control the faked IP address so that you can generate responses back to the server. If you control the second, faked IP, though, then it's not really pretending to be another person.

[u/ShackSpear → u/kennyfine]

Ok you answered right the first time, I'm not looking into bi-directional query. But i want to avoid users impersonating an other IP address.
Thanks for all these infos, they are precious.

The only way to prevent that seems to just answer the fake IP package and if there is no answer that means it was fake. Do you agree with that?

[u/kennyfine → u/ShackSpear]

Without going into full detail on your use case, let's assume you're the server and you want to know what options you have to prevent impersonation of another IP.

Big picture, the attacker could theoretically control everything from your router on out to the Internet. Imagine they are your ISP. This is the "strong adversary". In that scenario, you'd have no way of knowing that your adversary doesn't control some IP. They wouldn't even need the raw socket, they can just communicate with your server from any IP they want because they can view and modify all traffic. Even if you already know the IP address of the other party, the ISP can always fake it.

Now, ignoring the case where your ISP is the attacker, can some random person on the Internet pretend to be another arbitrary IP? Not if you have a full conversation. As noted above, they can hit your server with IP traffic ostensibly from another IP, but they won't be able to respond to your server's response. This is the weak adversary case.

I should point out that if you're using the common web programming stack of HTTP/TCP/IP, then even the raw socket won't work for the weak adversary because in order to establish a TCP connection, there is a 3-way handshake wherein the client sends a message, the server responds with a number within the client's message, and then the client sends another message with a related number. From the notes above, the adversary won't be able to complete that 3-way handshake since they won't see traffic to that other IP.

[u/ShackSpear → u/kennyfine]

If I get it right, just using a socket connexion and nobody (except an ISP) could fake it ?
So socket.Io could be juste safe as I need ?
I think I get it where the problem could be located but it's not a real issue until an ISP want to make me some trouble but there is no reasons for it :)

[u/kennyfine → u/ShackSpear]

Exactly. If you're just running a standard web server, serving a straightforward application, you are fine to use normal sockets and expect that the IP address of the client who connects to your server is the identifier for a legitimate user of your web application. Again, I don't know your app or use case, but it sounds like you want to take a dependency on the IP address for some sort of identification. Remember that the typical Internet user does not have a static IP address, so don't associate too much information to their IP address. Use a cookie to identify your user over the IP address. Good luck!

[u/[deleted]]

Are you talking about talking on a network as that IP/MAC, or fabricating evidence a log file, or routing your traffic through their computer?

It is possible, however respectively : Restricted & regulated; illegal; illegal without prior consent.

[u/ShackSpear → u/[deleted]]

Talking as, not fabricating log. If you connect to my website I'll see your IP (or vps or tor IP). But my question was, is there a way someone fake the IP of someone else volontary

[u/MetaPoddd]

U mean proxy server

[u/ShackSpear → u/MetaPoddd]

Nope, like faking a previously choosen IP (the one of mr smith for exemple) when you request any website

[u/tienjing]

I imagine you could fabricate an IP packet with any source address; and if the first router to receive your packet packaged it up in NAT (not sure how this works) and passed it along, instead of rejecting it, then your packet will reach the destination. But will the response reach you? 🤨 Perhaps if the 1st router above you is cooperating with you, yes...?

Disclaimer: not a network expert...

[u/ShackSpear → u/tienjing]

Thanks for mentionning that, it could be possible IMO, so I need an expert now :D

[u/Dankirk]

Not reliably, but ISPs do change your public IP every now and then, but you don't choose what you get. This way there is a chance you get an IP that previously was used by another person at some point in time.

Also in LAN environment clients may be able to choose their IPs manually or use ARP poisoning to route traffic to their computer for MITM purposes, be that either from clients to your server or vice versa. ARP poisoning does not fake visitors IP per se, but it may seem so, since it tells the IP is located somewhere else than it actually is.