I have a Java application that takes an action when another application starts and connects to it via a socket. The thing is that I only want the original application to take the action when the other application is on the local host. I check the IP address of the socket to confirm this, but could someone spoof the IP address of a Java socket? Or does Java automatically do some two-way checking? Right now it is set up so that the original program passes a random integer back and forth to confirm that the other program is where it says it is, but do I actually need to do this?