I am learning about Ingress Filtering where unauthorised packets are filtered out from entering the network.
To get a better understanding of it , I found an article which said:
the system examines all incoming packets to get information about their origins. The system compares this information to a database to determine if a packet is indeed from the place it says it is. If it appears to be a match, it can be allowed through. If there is a problem with the source, the system can hold the packet, keeping it out of the network and protecting any users who might be attached to the network.
I understand that if the spoofed packets are from a source address which is not in the database , it will not be allowed to enter the network.
Assuming a hacker spoof a source address which can be found in the database , when the system compares this information to the database information , a match will be found and the packet will enter the network though it has been spoofed.
I am wondering if the system is able to detect packets which has been spoofed with IP source address which could be found in the database and if yes how are such packets detected ??
EDIT : It appears the term "legitimate" and "illegitimate" has been causing alot of confusion so I have changed it to source address found in the database and source address not found in the database. I hoped this has made the question easier to understand