IP spoofing in and of itself is not illegal. It is often used as a valid method to generate traffic for capacity testing. Illegality occurs when someone uses spoofing to dupe another person. Think of it like a mask:  wearing a mask is not illegal, however, people who wear masks while robbing a bank are committing an illegal act.