Sounds like the LAN-D attack symptoms Erik Goldoff Systems Manager The HoneyBaked Ham Company
> -----Original Message----- > From: Mark Pays [mailto:[EMAIL PROTECTED] > Sent: Friday, February 20, 2004 1:35 PM > To: [EMAIL PROTECTED] > Subject: Re: [FW-1] Loopback address spoofing > > > I can see the very same thing happening to one of my > firewalls. It looks > like some kind of attempt to spoof the loopback address. Run > a tcpdump and > use -e to show ethernet source and dest MAC addresses. (I > used tcpdump -n -e > -i eth4c0 host 127.0.0.1). When I did this the packets > claiming to be from > 127.0.0.1 are actually originating from the internet router > MAC address. I > don't think it's of great concern as the firewall is dropping all the > packets but I'd be interested to hear if anyone knows anymore about it > though.. > -----Original Message----- > From: Jos� Mar�a Gabald�n [mailto:[EMAIL PROTECTED] > Sent: 20 February 2004 15:48 > To: [EMAIL PROTECTED] > Subject: [FW-1] Loopback address spoofing > > > Hi guys, > > I have a little problem, we have a Solaris running Check > Point NG FP3, and > everything works fine. However in the logs we get continously > (maybe every > 20 seconds or so) a drop log message that says: > Source: localhost > Destination: FW_EXTERNAL_IP_ADDRESS > Source port: http > Action: DROP > Reason: Loopback address spoofing. > > I guess what does this log entry means, could be some > internal hacker trying > to really spoof the loopback address of the firewall?, or > maybe is just a > misconfiugration?. If so, how can I troubleshoot the problem? > > I hope you can help me, thanks in advance! > _______________________________ > > Jos� Mar�a Gabald�n > Network Security Engineer > email: [EMAIL PROTECTED] > www.cybertech.com.ve > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > > > -------------------------------------------------------------- > ---------------- > The opinions expressed within this email represent those of the > individual and not necessarily those of Gullivers Travel > Associates (GTA). > > This email and any files transmitted with it are confidential > and intended solely for the use of the individual or entity > to whom they are addressed. > If you have received this email in error please notify > [EMAIL PROTECTED] > > Should you wish to use email as a form of communication, GTA > are unable to > guarantee the security of email content outside of our own > computer systems. > > > ______________________________________________________________________ > This email has been scanned by the MessageLabs Email Security System. > For more information please visit http://www.messagelabs.com/email > ______________________________________________________________________ > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [EMAIL PROTECTED] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [EMAIL PROTECTED] > ================================================= > ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
