He set out to understand exactly what happened and why, and to see if he could use the electronic traces the intruder left behind to track him down. The attack was based on the intruder's ability to fake the source address of the packets that are sent to a system. Some systems and applications decide whether to trust another system to send it commands by looking at the source address on the incoming packets. That was the case with Shimomura's otherwise well-protected system. The intruder got access by making it appear that the packets came from a system other than the one they were really coming from.
Packets are the messages, or sections of messages, that are sent from one computer to another.
Rather than being transmitted directly from one computer to another, these packets bounce from system to system to system, using the best route available to it on the Internet's huge collection of interconnected networks. Addresses attached to the packets are interpreted by the protocols that make the Internet work. One of these, called the Internet Protocol, or IP, was the source of the attack on Shimomura. What the intruder did was to send file transfer commands to Shimomura's computer that looked like they came from a computer that was authorized to read these files. The attack was a particularly tricky one.