For instance, he would need a way to knock Jane off the air at will. He also would need a way to know the exact status of Jane's session at the moment he mounted his attack. Both of these require that John have far more knowledge about and control over the session than normally would be possible. Although both attacks are possible and we recommend that you take them seriously, there is a fair amount of hype surrounding them. However, Windows NT in general does not use IP addresses for authentication.
Every session requires a challenge-response authentication.
Neither IP address spoofing nor session hijacking are possible if per-packet integrity checking is performed. Neither IP address spoofing nor session hijacking are possible if session encryption such as SSL or PPTP are used, because the attacker will not have a way to participate in the key exchange. There are no known tools that do blind session hijacking or IP address spoofing, and it is extremely difficult to build such a tool. Therefore, each attack must be performed by hand, making it possible only to very high-level hackers. Additional information Please see the following references for more information related to this issue.