• Each packet that reaches your router asks one question: where do I send this?
    To answer this, your router looks up the destination address in its routing table.

    Traditional IP Routing

    A packet arrives on G0/0 from your LAN, headed for 203.0.113.50 on the Internet.

    Router R1 performing a destination lookup only on an incoming IP packet, without checking the source address

    Figure 1 – Only the destination is looked up

    Your router will check its routing table to find a route that matches this destination.
    You can use the following command:

    R1# show ip route 203.0.113.50
Routing entry for 203.0.113.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 10.0.1.2, via GigabitEthernet0/1
      Route metric is 0, traffic share count is 1

    There it is.

    203.0.113.0/24 is reachable via G0/1, so your router forwards the packet out of that interface.

    IP packet forwarded from the LAN to the Internet through router R1 after a destination lookup

    Figure 2 – Forwarded out of G0/1

    That is the whole process.

    Answer the question below

    Which address does your router look up to forward a packet?

    The Source Is Never Checked

    Now, notice what did not happen.
    Your router never asked whether 192.168.1.10 was a plausible source address.

    Nothing stops a host on your LAN from writing any source address it wants.
    This is IP spoofing!

    Attacker on the LAN sending a packet with the forged source address 192.0.2.99 that router R1 forwards toward the Internet

    Figure 3 – A forged source, forwarded anyway

    Put yourself in your router's place.
    No protection mechanism is enabled on it, so it does exactly what it did before: it looks up the destination in its routing table.

    R1# show ip route 203.0.113.50
Routing entry for 203.0.113.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 10.0.1.2, via GigabitEthernet0/1
      Route metric is 0, traffic share count is 1

    Your router forwards them all, without ever questioning that address.
    What does that buy an attacker?

    A host that lies about its source address can:

    • hide where the traffic really comes from

    • send the replies to a victim instead of itself

    • slip past your filters that trust internal addresses

    Answer the question below

    Forging the source address of a packet is called IP ________

    Turning uRPF On

    Now, let's configure uRPF.
    It cannot run without CEF, so that one goes on first:

    R1# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)# ip cef
R1(config)# interface g0/0
R1(config-if)# ip verify unicast source reachable-via rx
R1(config-if)# end

    One line on your interface, and every packet arriving on G0/0 now gets its source address checked.
    Now, a malicious host sends a packet with a source address of 192.0.2.99.

    Your router checks whether that source address exists in its routing table.
    If no route matches it, your router drops the packet.

    Router R1 dropping a spoofed packet whose source address 192.0.2.99 has no matching route in the routing table

    Figure 4 – No route to the source, packet dropped

    Let's simulate that scenario and forge a packet with the source address 192.0.2.99.

    R2 sits on your LAN, and its Loopback 1 carries the forged address. Send five packets from it:

    R2# ping 203.0.113.50 source loopback 1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 203.0.113.50, timeout is 2 seconds:
Packet sent with a source address of 192.0.2.99
.....
Success rate is 0 percent (0/5)

    Five dots, not one reply.
    Go and look on R1:

    R1# show ip interface g0/0 | include verif
  IP verify source reachable-via RX
  5 verification drops
  0 suppressed verification drops
  0 verification drop-rate

    Five spoofed packets, five drops.

    Answer the question below

    uRPF searches for the source address in the _______ table