{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,26]],"date-time":"2026-10-26T14:59:18Z","timestamp":1793026758714,"version":"4.5.0"},"reference-count":46,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2009,5,1]],"date-time":"2009-05-01T00:00:00Z","timestamp":1241136000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Internet Technol."],"published-print":{"date-parts":[[2009,5]]},"abstract":"<jats:p>IP source address spoofing has plagued the Internet for many years. Attackers spoof source addresses to mount attacks and redirect blame. Researchers have proposed many mechanisms to defend against spoofing, with varying levels of success. With the defense mechanisms available today, where do we stand? How do the various defense mechanisms compare? This article first looks into the current state of IP spoofing, then thoroughly surveys the current state of IP spoofing defense. It evaluates data from the Spoofer Project, and describes and analyzes host-based defense methods, router-based defense methods, and their combinations. It further analyzes what obstacles stand in the way of deploying those modern solutions and what areas require further research.<\/jats:p>","DOI":"10.1145\/1516539.1516541","type":"journal-article","created":{"date-parts":[[2009,5,12]],"date-time":"2009-05-12T12:52:36Z","timestamp":1242132756000},"page":"1-29","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":66,"title":["On the state of IP spoofing defense"],"prefix":"10.1145","volume":"9","author":[{"given":"Toby","family":"Ehrenkranz","sequence":"first","affiliation":[{"name":"University of Oregon, Eugene, OR"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jun","family":"Li","sequence":"additional","affiliation":[{"name":"University of Oregon, Eugene, OR"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2009,5,11]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1059513.1059517"},{"key":"e_1_2_1_2_1","volume-title":"Proceedings of the Networld\/Interop.","author":"Albrightson B."},{"key":"e_1_2_1_3_1","volume-title":"Proceedings of the International Conference on Information and Communication Security, Y. Han et al., Eds. Lecture Notes in Computer Science","volume":"1334","author":"Aura T."},{"key":"e_1_2_1_4_1","doi-asserted-by":"crossref","unstructured":"Baker F. 1995. Requirements for IP Version 4 routers. RFC 1812.   Baker F. 1995. Requirements for IP Version 4 routers. RFC 1812.","DOI":"10.17487\/rfc1812"},{"key":"e_1_2_1_5_1","doi-asserted-by":"crossref","unstructured":"Baker F. and Savola P. 2004. Ingress Filtering for Multihomed Networks. RFC 3704.   Baker F. and Savola P. 2004. Ingress Filtering for Multihomed Networks. RFC 3704.","DOI":"10.17487\/rfc3704"},{"key":"e_1_2_1_6_1","unstructured":"Bernstein D. J. 1996. SYN cookies. http:\/\/cr.yp.to\/syncookies.html.  Bernstein D. J. 1996. SYN cookies. http:\/\/cr.yp.to\/syncookies.html."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24668-8_16"},{"key":"e_1_2_1_8_1","volume-title":"Proceedings of the USENIX Work-Shop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI), 53--59","author":"Beverly R."},{"key":"e_1_2_1_9_1","volume-title":"Proceedings of the Annual Joint Conference of the IEEE Computer and Communications Societies (InfoCom).","author":"Bremler-Barr A."},{"key":"e_1_2_1_10_1","volume-title":"Proceedings of the Annual Joint Conference of the IEEE Computer and Communications Societies (InfoCom). 2372--2382","author":"Feng W."},{"key":"e_1_2_1_11_1","unstructured":"Cisco Systems Inc. 2007. Configuring TCP intercept. http:\/\/www.cisco.com\/en\/US\/docs\/ios\/security\/configuration\/guide\/sec_cfg_tcp_intercpt.pdf  Cisco Systems Inc. 2007. Configuring TCP intercept. http:\/\/www.cisco.com\/en\/US\/docs\/ios\/security\/configuration\/guide\/sec_cfg_tcp_intercpt.pdf"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/505586.505588"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.1976.1055638"},{"key":"e_1_2_1_14_1","volume-title":"Proceedings of the Annual Joint Conference of the IEEE Computer and Communications Societies (InfoCom).","author":"Duan Z."},{"key":"e_1_2_1_15_1","unstructured":"Ehrenkranz T. and Li J. 2007. An incrementally deployable protocol for learning the valid incoming direction of IP packets. Tech. rep. CIS-TR-2007-05 University of Oregon. March.  Ehrenkranz T. and Li J. 2007. An incrementally deployable protocol for learning the valid incoming direction of IP packets. Tech. rep. CIS-TR-2007-05 University of Oregon. March."},{"key":"e_1_2_1_16_1","doi-asserted-by":"crossref","unstructured":"Ferguson P. and Senie D. 2000. Network ingress filtering: Defeating denial of service attacks which employ IP source address spoofing. RFC 2827.   Ferguson P. and Senie D. 2000. Network ingress filtering: Defeating denial of service attacks which employ IP source address spoofing. RFC 2827.","DOI":"10.17487\/rfc2827"},{"key":"e_1_2_1_17_1","unstructured":"Fyodor. 2006. Remote OS detection. http:\/\/nmap.org\/book\/osdetect.html.  Fyodor. 2006. Remote OS detection. http:\/\/nmap.org\/book\/osdetect.html."},{"key":"e_1_2_1_18_1","volume-title":"Proceedings of the Network and Distributed System Security Symposium.","author":"Goodell G."},{"key":"e_1_2_1_19_1","volume-title":"Proceedings of IEEE Conference and Exhibition on Global Telecommunications (GlobeCom).","author":"He Y."},{"key":"e_1_2_1_20_1","volume-title":"Proceedings of IEEE Conference and Exhibition on Global Telecommunications (GlobeCom).","author":"He Y."},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/948109.948116"},{"key":"e_1_2_1_22_1","doi-asserted-by":"crossref","unstructured":"Kent S. and Seo K. 2005. Security architecture for the Internet Protocol. RFC 4301.  Kent S. and Seo K. 2005. Security architecture for the Internet Protocol. RFC 4301.","DOI":"10.17487\/rfc4301"},{"key":"e_1_2_1_23_1","doi-asserted-by":"crossref","unstructured":"Killalea T. 2000. Recommended Internet service provider security services and procedures. RFC 3013.   Killalea T. 2000. Recommended Internet service provider security services and procedures. RFC 3013.","DOI":"10.17487\/rfc3013"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/1229285.1229293"},{"key":"e_1_2_1_25_1","volume-title":"Proceedings of the Annual Joint Conference of the IEEE Computer and Communications Societies (InfoCom). 1557--1566","author":"Li J."},{"key":"e_1_2_1_26_1","volume-title":"Proceedings of USENIX Symposium on Networked Systems Design and Implementation.","author":"Liu X."},{"key":"e_1_2_1_27_1","unstructured":"Martin K. 2006. Stop the bots. Security Focus.  Martin K. 2006. Stop the bots. Security Focus."},{"key":"e_1_2_1_28_1","unstructured":"Messmer E. 2007. Report says identity thieves working hand in hand with \u2018bot herders\u2019. Network World.  Messmer E. 2007. Report says identity thieves working hand in hand with \u2018bot herders\u2019. Network World."},{"key":"e_1_2_1_29_1","unstructured":"MIT Advanced Network Architecture Group. 2007. ANA Spoofer Project. http:\/\/spoofer.csail.mit.edu\/.  MIT Advanced Network Architecture Group. 2007. ANA Spoofer Project. http:\/\/spoofer.csail.mit.edu\/."},{"key":"e_1_2_1_30_1","doi-asserted-by":"crossref","unstructured":"Moy J. 1998. OSPF Version 2. RFC 2328 (Standard).  Moy J. 1998. OSPF Version 2. RFC 2328 (Standard).","DOI":"10.17487\/rfc2328"},{"key":"e_1_2_1_31_1","doi-asserted-by":"crossref","unstructured":"Oran D. 1990. OSI IS-IS Intra-domain Routing Protocol. RFC 1142 (Informational).   Oran D. 1990. OSI IS-IS Intra-domain Routing Protocol. RFC 1142 (Informational).","DOI":"10.17487\/rfc1142"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/383059.383061"},{"key":"e_1_2_1_33_1","unstructured":"Piscitello D. M. 2006. Anatomy of a DNS DDoS amplification attack. http:\/\/www.watchguard.com\/infocenter\/editorial\/41649.asp.  Piscitello D. M. 2006. Anatomy of a DNS DDoS amplification attack. http:\/\/www.watchguard.com\/infocenter\/editorial\/41649.asp."},{"key":"e_1_2_1_34_1","doi-asserted-by":"crossref","unstructured":"Rekhter Y. Li T. and Hares S. 2006. A Border Gateway Protocol 4 (BGP-4). RFC 4271 (Draft Standard).  Rekhter Y. Li T. and Hares S. 2006. A Border Gateway Protocol 4 (BGP-4). RFC 4271 (Draft Standard).","DOI":"10.17487\/rfc4271"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/357401.357402"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/347059.347560"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2002.804827"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-45248-5_11"},{"key":"e_1_2_1_39_1","volume-title":"Proceedings of the DARPA Information Survivability Conference and Exposition","volume":"1","author":"Templeton S. J."},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2006.890133"},{"key":"e_1_2_1_41_1","volume-title":"Proceedings of the Annual International Conference on Network Protocols (ICNP'07)","author":"Wu J."},{"key":"e_1_2_1_42_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy, 93--107","author":"Yaar A."},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2006.877138"},{"key":"e_1_2_1_44_1","unstructured":"Zalewski M. 2001. Strange attractors and TCP\/IP sequence number analysis. http:\/\/lcamtuf.coredump.cx\/oldtcp\/.  Zalewski M. 2001. Strange attractors and TCP\/IP sequence number analysis. http:\/\/lcamtuf.coredump.cx\/oldtcp\/."},{"key":"e_1_2_1_45_1","unstructured":"Zalewski M. 2002. Strange attractors and TCP\/IP sequence number analysis\u2014One year later. http:\/\/lcamtuf.coredump.cx\/newtcp\/.  Zalewski M. 2002. Strange attractors and TCP\/IP sequence number analysis\u2014One year later. http:\/\/lcamtuf.coredump.cx\/newtcp\/."},{"key":"e_1_2_1_46_1","unstructured":"Zalewski M. 2006. Passive OS fingerprinting tool. http:\/\/lcamtuf.coredump.cx\/p0f.shtml.  Zalewski M. 2006. Passive OS fingerprinting tool. http:\/\/lcamtuf.coredump.cx\/p0f.shtml."}],"container-title":["ACM Transactions on Internet Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1516539.1516541","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1516539.1516541","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T13:30:06Z","timestamp":1750253406000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1516539.1516541"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009,5]]},"references-count":46,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2009,5]]}},"alternative-id":["10.1145\/1516539.1516541"],"URL":"https:\/\/doi.org\/10.1145\/1516539.1516541","relation":{},"ISSN":["1533-5399","1557-6051"],"issn-type":[{"value":"1533-5399","type":"print"},{"value":"1557-6051","type":"electronic"}],"subject":[],"published":{"date-parts":[[2009,5]]},"assertion":[{"value":"2007-09-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2008-05-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2009-05-11","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}