Marek Majkowski - IP Spoofing

### The Persistent Plague of IP Spoofing in Volumetric DDoS At 00:00, Marek Majkowski of Cloudflare opens with an analysis of IP address spoofing and its central role in modern Distributed Denial-of-Service (DDoS) attacks. Drawing on Cloudflare's experience protecting global Internet infrastructure, Majkowski notes that while application-layer attacks (HTTP floods) require established TCP connections, the largest volumetric attacks that congest transit pipes rely heavily on stateless UDP reflection and amplification—which are made possible solely through IP address spoofing.

### Mechanics of UDP Amplification and Reflection At 07:15 and 14:20, Majkowski breaks down how attackers weaponize spoofed packets against vulnerable Internet protocols. By forging the source IP address in UDP request headers to match the target victim's IP, an attacker sends small requests to open third-party servers—such as DNS resolvers, NTP servers, SSDP devices, and Memcached daemons. The servers respond by directing massive amplification payloads back to the unsuspecting victim, overwhelming upstream transit links without exposing the attacker's true network location.

### Why BCP 38 Has Not Solved Global Spoofing At 25:45 and 33:10, the speaker addresses the industry's failure to eradicate spoofing despite the existence of Best Current Practice 38 (BCP 38 - Network Ingress Filtering) published in the year 2000. Majkowski examines global telemetry from the CAIDA Spoofer project, explaining that while tier-1 transit backbones generally drop spoofed packets, thousands of regional ISPs, enterprise stub networks, and international telecommunications operators fail to implement basic reverse-path filtering. A tiny fraction of unvalidated networks is sufficient to generate multi-hundred-gigabit attacks.

### Stateful vs. Stateless Spoofing and SYN Floods At 40:20 and 46:15, the presentation explores spoofing within the TCP protocol. While completing a standard three-way handshake requires receiving the server's SYN-ACK (which goes to the spoofed address), attackers routinely flood web services with spoofed TCP SYN packets. Majkowski explains the operational impact: server operating systems allocate memory for half-open connections in SYN queues, leading to resource exhaustion. He details Cloudflare's deployment of SYN cookies and stateless connection tracking to mitigate spoofed TCP floods at the edge.

### Detection Methodologies and Defensive Coordination Concluding between 49:00 and 51:35, Majkowski reviews how large network operators identify spoofed attack traffic. He demonstrates using hop-count analysis (comparing received TTL values against expected geographical baseline paths) and TCP timestamp validation to differentiate legitimate packets from forged traffic. He calls upon global network operators and transit providers to enforce strict source address validation across all customer links, emphasizing that eliminating IP spoofing requires collective industry accountability.

(AI summary — Gemini 3.8 Flash)