spoofing
Imagine mailing a letter but writing someone else's name and address as the sender. The post office doesn't check — it just delivers, and the recipient trusts the return address printed on it. Spoofing is exactly this: an attacker forges the source identity of a message so it appears to come from someone it didn't. Because many network protocols simply trust whatever a packet claims about itself, faking that claim is often easy.
Spoofing comes in flavors at every layer, because identity is claimed at every layer. IP spoofing means putting a false source IP address in a packet's header — the network forwards it based on the destination, never verifying the source, so the packet looks like it came from another machine. ARP spoofing forges the mapping between an IP address and a MAC address on a local network. DNS spoofing forges the answer to a name lookup so a victim connects to the wrong server. Email spoofing forges the From line. In each case the attacker exploits a protocol that takes a claimed identity at face value.
Why it matters: spoofing is the building block of many bigger attacks. A spoofed source IP lets an attacker hide and is the heart of reflection and amplification floods (the replies go to the spoofed victim). Spoofed ARP or DNS answers redirect victims into a man-in-the-middle position. The defense is authentication — cryptographically proving identity rather than trusting a claim. This is why we have signed DNS records (DNSSEC), authenticated email (SPF, DKIM, DMARC), and TLS certificates: they replace 'trust the return address' with 'prove it.'
An attacker sends a UDP packet to a DNS server but writes the victim's IP as the source. The server's large reply goes not to the attacker but to the victim — a tiny forged request triggers a flood aimed at someone else. That single forged source address is spoofing at work.
Forge the 'from' field and the network trusts it.
Spoofing works because classic protocols verify identity by trust, not proof. The fix is never 'check harder by hand' — it is cryptographic authentication (signatures, MACs, certificates) that makes a forged identity detectable.