Disclosed is a method for routing data packets, as is a data packet router (10) that operates in accordance with the invention. The method includes establishing an ingress filter (20) in individual ones of a plurality of line cards (14) installed within a router and automatically maintaining a content of an ingress filter table (20A) of each ingress filter in each line card at least partially in accordance with data packets passing through individual ones of the line cards, where the content includes an identification of source addresses of hosts (16) coupled to the router. The method further compares a source address of an incoming packet to a line card to the content of the ingress filter table of that line card, and is thus enabled to detect the presence of an IP packet containing a spoofed IP host address. For a first occurrence of a packet having an IP source address that is not found in the ingress filter table, the packet is forwarded to a route processor (12) for analysis. The method further includes changing the content of the ingress filter table based on a result of the analysis to add the source address to the content of the ingress filter table, if the route processor has knowledge that the IP source address is associated with a valid host. At least some of the packets are Internet Protocol control packets, such as Routing Protocol Update packets, Dynamic Host Configuration Protocol packets, BootTP packets and Address Resolution Protocol packets. At least some of the hosts may be mobile hosts capable of connection and disconnection at different points in a subnet (22).