This is very common, lots of zombies spew out huge amounts of garbage packets with a source address of 127.0.0.1 (among others). Even though 127.0.0.1 is a well-known bogon ISPs still route it even though there is no valid route back to it. I filter this and many other blocks using router ACLs. This keeps the level of needless entries in my firewall logs down and saves some overhead as well on my enforcement points.
In general you should filter the following IP ranges at your internet border going both directions as there's no good reason any of this should leave or enter your network: 10.0.0.0/8 RFC-1918 172.16.0.0/12 RFC-1918 192.168.1.0/16 RFC-1918 127.0.0.1/32 Standard lookback IP 224.0.0.0/3 (multicast and reserved IANA IP space) There's also all sorts of ports that you can filter as well: you'd be amazed at the huge amount of netbios, sql, wins, bootp and other garbage traffic that will get sent to you. Why anyone should recieve someone else's wins requests is beyond me, all it does is fill up your log files. You may also be suprised at the amount of garbage you send too. Filtering it coming into your network is fine and good but make sure you aren't contributing to the vast amount of background noise on the internet. Remember, if you don't want to recieve it you probably don't want to leak it either. Regards, Greg Pendergrass -----Original Message----- From: Mark Pays [mailto:[EMAIL PROTECTED] Sent: 20 February 2004 18:35 To: [EMAIL PROTECTED] Subject: Re: [FW-1] Loopback address spoofing I can see the very same thing happening to one of my firewalls. It looks like some kind of attempt to spoof the loopback address. Run a tcpdump and use -e to show ethernet source and dest MAC addresses. (I used tcpdump -n -e -i eth4c0 host 127.0.0.1). When I did this the packets claiming to be from 127.0.0.1 are actually originating from the internet router MAC address. I don't think it's of great concern as the firewall is dropping all the packets but I'd be interested to hear if anyone knows anymore about it though.. -----Original Message----- From: Jos� Mar�a Gabald�n [mailto:[EMAIL PROTECTED] Sent: 20 February 2004 15:48 To: [EMAIL PROTECTED] Subject: [FW-1] Loopback address spoofing Hi guys, I have a little problem, we have a Solaris running Check Point NG FP3, and everything works fine. However in the logs we get continously (maybe every 20 seconds or so) a drop log message that says: Source: localhost Destination: FW_EXTERNAL_IP_ADDRESS Source port: http Action: DROP Reason: Loopback address spoofing. I guess what does this log entry means, could be some internal hacker trying to really spoof the loopback address of the firewall?, or maybe is just a misconfiugration?. If so, how can I troubleshoot the problem? I hope you can help me, thanks in advance! _______________________________ Jos� Mar�a Gabald�n Network Security Engineer email: [EMAIL PROTECTED] www.cybertech.com.ve ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ---------------------------------------------------------------------------- -- The opinions expressed within this email represent those of the individual and not necessarily those of Gullivers Travel Associates (GTA). This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify [EMAIL PROTECTED] Should you wish to use email as a form of communication, GTA are unable to guarantee the security of email content outside of our own computer systems. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= Vodafone Global Content Services Limited Registered Office: Vodafone House, The Connection, Newbury, Berkshire RG14 2FN Registered in England No. 4064873 This e-mail is for the addressee(s) only. If you are not an addressee, you must not distribute, disclose, copy, use or rely on this e-mail or its contents, and you must immediately notify the sender and delete this e-mail and all copies from your system. Any unauthorised use may be unlawful. The information contained in this e-mail is confidential and may also be legally privileged. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
