Q: You see logs indicating that packets arriving from the public internet have a source IP of `10.0.5.50` (a private IP in your own corporate network). What is this attack, and how is it stopped at the network border?
This is an IP Spoofing attack. The attacker manually alters the IP header of their malicious packet to falsely claim it originated from a...
🛠️ Production Runbook & Step-by-Step Resolution
Production Solution & Architecture
This is an IP Spoofing attack. The attacker manually alters the IP header of their malicious packet to falsely claim it originated from an internal, trusted IP, hoping your internal network implicitly trusts it and bypasses firewalls. This is thwarted using uRPF (Unicast Reverse Path Forwarding) globally on border routers (often enforced by ISPs per BCP38), and Strict Ingress Filtering on corporate firewalls. The border firewall evaluates the packet: "If I wanted to reply to this source IP 10.0.5.50, my routing table says it lives on my internal LAN interface. But the packet just physically arrived on my external WAN interface. It's geographically impossible." The router instantly drops it as a spoofed packet.
- Immediate Triage: This is an IP Spoofing attack. The attacker manually alters the IP header of their malicious pa
- Run targeted verification commands before modifying configuration.
- Automate permanent guardrails (CI check, alerts, IaC policy) to prevent recurrence.