From the way I understand it, Source based RTBH (http://packetlife.net/blog/2010/aug/23/source-based-rtbh/) works on the principle that only if the routing entry for the IP address is present, it will allow the packet through.
My understanding is that if I initiate the connection to 126.96.36.199 (which is on the internet) then the response will be allowed to enter as the FIB will see that the request was actually initiated from my end (hopefully this is a correct understanding).
My question is that at any given time.. someone will always be on Google, or Wikipedia. So how can one prevent an attack from someone who is spoofing their IP and using the IP of a large organisation such as Google or Wikipedia.
If my understanding is correct, If I initiate the connection to Google, then the response will be allowed in (as the FIB will see that I sourced it), but how would it know that it was someone impersonating Google that is re-entering.