RFC 2267, "Network Ingress Filtering: Defeating Denial of Service Attacks Which Employ IP Source Address Spoofing" by Paul Ferguson and Daniel Senie details methods for filtering spoofed packets on your network