Re: IP Spoofing.

["Steven M. Bellovin" <smb () research att com>]

In message <v04205502b4089b713655@[10.1.1.212]>, "Christopher C. Petro" writes:
> Ok, this is probably not the kind of request that most of you will 
> want to answer, but I just got in an argument with my boss about IP 
> spoofing. He claims it is not possible to spoof an IP number, whilst 
> I am almost certain it is.
>
> Could anyone provide me with a link or pointer to information that I 
> could use to prove him wrong, or to information that proves me wrong?

If by "IP number" you mean IP address -- yes, you're quite correct.  See, for 
example, 
http://www.cert.org/advisories/CA-95.01.IP.spoofing.attacks.and.hijacked.terminal.connections.html 
or http://www.research.att.com/~smb/papers/ipext.ps (.pdf also available).

There's a lot more besides.

                --Steve Bellovin