IP spoofing is a technique woven through many DDoS attack vectors, the forging of a packet's source address, and validating a defense against it is part of a thorough DDoS test. Because a raw IP packet carries whatever source address the sender writes into it, an attacker on a network that does not check can stamp any address they like and the packet still routes.
How address forgery works
The source-address field is unauthenticated by design. Nothing in the IP header proves the sender is who it claims to be, so on a network that forwards spoofed packets, forging the source is trivial.
The catch is that spoofing only helps when the attacker does not need the reply. This is why it pairs with connectionless UDP and ICMP rather than TCP. A TCP connection begins with a three-way handshake, and the server's SYN-ACK carries a random initial sequence number that the client must echo back. An attacker forging a source address never sees that number, so they cannot complete the handshake. This return-routability check is why blind TCP spoofing is impractical and why the loudest spoofed floods live in the UDP world.
Two uses dominate. The first is evasion: a flood where every packet carries a different forged source has no stable address to block, so per-IP thresholds and reputation feeds have nothing to grip. The second is redirection, which is the engine of the whole reflection family. The attacker sets the source to the victim's address and sends a small query to an open server, and that server dutifully sends its reply to the victim. Combined with a large response, this is the basis of every reflection attack and UDP reflection and amplification vector, where the spoofed source is what points the amplified reply at the target.
Why it matters under attack
Spoofing changes what a defense can even see. Blocklists chase addresses that were never real, geo-filters trust a country field the attacker chose, and forensic logs record thousands of victims who sent nothing. The structural countermeasure lives at the network edge, not in the application.
BCP 38 (RFC 2827) is ingress filtering: a provider drops a packet arriving on a customer link if its source address could not legitimately originate there. uRPF (unicast reverse-path forwarding) automates the same idea by consulting the routing table, and it runs in strict, loose, or feasible-path modes depending on how symmetric the routing is. Both push the fix upstream, close to the attacker, where the true source is still knowable.
The trouble is deployment. The CAIDA Spoofer project has measured source-address filtering across the internet for years and consistently finds that a large share of tested networks still permit spoofed egress, which is why the technique remains viable at scale. The consequences are on the record: the February 2018 memcached reflection event that hit GitHub at roughly 1.35 Tbps only worked because spoofed source addresses let a handful of queries redirect terabits of reflected traffic at one target.
What a DDoS test measures
There are two questions a test answers, and they point in opposite directions. Inbound, it characterizes how a defense copes when source addresses are worthless: do per-IP rate limits and reputation collapse under a spoofed flood, and does mitigation fall back to signals that forgery cannot touch, such as protocol validation, BCP 38 enforcement upstream, or challenge-based checks that require a real round trip?
Outbound, a test audits whether the network under assessment is a good citizen. Sending packets with a forged source from inside the network and watching whether they escape to the internet is a direct check of uRPF and ingress filtering: if they leave, the network can be conscripted as a reflection source against someone else, and closing that is both a defensive and a neighborly fix. Spoofing rarely fails a target on its own, but it decides which of a defense's signals are trustworthy under load, which is exactly what DDoS resilience testing is meant to surface.