IP Spoofing.

IP spoofing rewrites the 32-bit (IPv4) or 128-bit (IPv6) source-address field in a packet header so it appears to come from a different machine. Because the classic Internet forwards datagrams on destination alone and never verifies the source, a host can emit packets claiming almost any origin. Attackers exploit this to evade ACLs that trust specific addresses, hide the origin of scans, mount blind or off-path TCP attacks, and — most damagingly — power reflection/amplification DDoS: the attacker sends small queries to open reflectors (DNS, NTP, memcached, CLDAP) with the victim's IP as the forged source, so every large reply lands on the victim.

The technique underpins the biggest floods on record. The 1997 Smurf attack spoofed the victim's address into ICMP echo requests sent to broadcast, so whole subnets replied. In February 2018 GitHub was hit by a ~1.35 Tbps memcached amplification flood built entirely on spoofed UDP to port 11211, then a still-larger one struck a US provider days later.

The fix mostly lives with network operators, not the victim. BCP 38 (RFC 2827) and BCP 84 ingress filtering, unicast Reverse Path Forwarding (uRPF), and Source Address Validation (SAVI) drop forged packets at the edge before they leave. Authenticated transports (TLS, IPsec) and TCP's random sequence numbers defeat the impersonation downstream.

flowchart LR
  A[Attacker] -->|src = Victim IP| R[Open reflector<br/>DNS / NTP / memcached]
  R -->|large reply to spoofed src| V[(Victim)]
  subgraph Defence
    E[Edge router: BCP 38 / uRPF]
  end
  A -.forged packet dropped.-> E