What is spoofing; what do the Spoofing, LAND / Self-Spoof and Martians settings in TR7 catch?

Short answer

Spoofing is presenting the source address of a packet or an ARP reply with an identity that is not the real one; in attacks, it is used to hide the source address or to reflect traffic to another target (RFC 2827). In TR7, there are three settings under this name. The LAND / Self-Spoof rule in the Packet Integrity band of L4 DDoS Management catches packets that come from outside and show one of TR7's own addresses as the source (default value Block); the Martians rule catches, only on IPv4, packets sourced from 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10 and 169.254.0.0/16 (default value Monitor; since the Local Networks entry in the exemption list exempts four of these ranges, unless the entry is removed, the rule is effective only for 100.64.0.0/10). Neither rule has a threshold. The Spoofing setting on the Backend Service, on the other hand, is not an attack rule: while SNAT = Use Client IP is selected, it performs ARP spoofing so that the Backend Service's replies return through TR7.

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management → Packet Integrity → Malformed Packets box	LAND / Self-Spoof: Status (Disabled · Monitor · Block · Quarantine)	Monitoring or dropping outside packets that carry TR7's own address
The same box	Martians: Status (Disabled · Monitor · Block; no Quarantine)	Monitoring or dropping IPv4 packets that claim to come from private and reserved ranges
Route table → L4 DDoS Management → Whitelist & Known Peers	Local Networks (XX) entry	Exempts the private ranges; it is removed for Martians to work with full scope
Configuration Menu → Load Balancer → Backend Services → Add / Edit	SNAT = Use Client IP → Spoofing, Spoofing IP; in a cluster, Spoofing IP VIP Condition, Spoofing Default Device	Replies returning to TR7 without the gateway being changed while the client IP is preserved
Configuration Menu → Settings → General Settings → IP Intelligence & Reputation	IP category Spoofing	Addresses reported for e-mail sender spoofing; it has nothing to do with IP address spoofing

• The measurement panels of the two rules are on the Suspicious Packets tab of the route table Dashboard; the measurement of Martians covers only IPv4 traffic (measurement and dashboard).
• The relationship of the Spoofing on the Backend Service with ARP: What is ARP; how does it relate to VIP failover and the Spoofing setting in TR7?
• The requirements for forwarding the client IP to the Backend Service in preserved form: Is it possible to work without SNAT (transparent mode); what are the requirements?

Common Misconceptions

• "Spoofing on the Backend Service is an attack." It is a deliberate network technique used to forward the client IP to the Backend Service while preserving it; it is off by default and appears only while Use Client IP is selected.
• "While the Martians rule is on, every packet coming from private networks is dropped." The default Local Networks exemption exempts the 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 169.254.0.0/16 ranges before the rule; in addition, the rule works only on IPv4.
• "These rules work when a threshold is exceeded." LAND / Self-Spoof and Martians have no threshold; the decision is made by looking at the packet itself.
• "The Spoofing category in IP Reputation lists spoofed source addresses." The category holds addresses reported for e-mail sender spoofing.

How it is done in the documentation

• Malformed Packets · LAND / Self-Spoof
• Malformed Packets · Martians
• Whitelist & Known Peers
• Backend Services · Spoofing

Related questions

• What kind of security risk arises if Trusted Proxy is misconfigured (IP Spoofing)?
• Is it possible to work without SNAT (transparent mode); what are the requirements?
• What is a Reflection & Amplification attack; how does the TR7 device protect against this attack?