It sounds like to me that the internal network and external network are somehow connected together (through a hub or switch, etc...) and the GB is seeing this mixed traffic coming from the wrong directions.
Sincerely, Mason Landrum CONFIDENTIAL INFORMATION: Pursuant to State and Federal Law, the information that is being transmitted in this e-mail is confidential and legally privileged information and may not be reviewed by unauthorized parties. It is intended only for the use of the person listed as the recipient. If this information has been transmitted to you in error, please immediately notify the sender. -----Original Message----- From: Steve J. Drenner [mailto:[EMAIL PROTECTED] Sent: Friday, August 20, 2004 3:23 PM To: [EMAIL PROTECTED] Subject: [gb-users] Weird alarm I am getting the following in the error log of a customers GB-500 Aug 20 12:23:10 pri=4 flt_action=block count=1 msg="Possible spoof, return interface doesn't match arrival interface" proto=80/tcp src=9.171.204.145 srcport=4651 dst=66.254.105.3 dstport=80 interface=r10 attribute=alarm flags=0x2 I have tons (and I mean TONS) of these the src ip is changing and the dst ip goes between 66.254.105.3, .5, .1 And none of these are ip's that my customer is using not even in the same or close to same subnet. Any thoughts on how to clean this up? Thanks Steve ------------------------------------------------------ To unsubscribe: [EMAIL PROTECTED] For additional commands: [EMAIL PROTECTED] Archive: http://archives.gnatbox.com/gb-users/ ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ------------------------------------------------------ To unsubscribe: [EMAIL PROTECTED] For additional commands: [EMAIL PROTECTED] Archive: http://archives.gnatbox.com/gb-users/
