Re: Firewall log 192.168.100.1:65535 224.0.0.1:65535

[Matt . Carpenter]

It doesn't matter whether your IP's are static or dynamic.  What matters is
whether they are registered or not (if they're in those ranges already
listed, they are NOT)



                                                                                       
                                            
                    Joel Hammer                                                        
                                            
                    <Joel@hammershom        To:     [EMAIL PROTECTED]               
                                            
                    e.com>                  cc:                                        
                                            
                    Sent by:                Subject:     Re: Firewall log 
192.168.100.1:65535 224.0.0.1:65535                      
                    linux-users-admi                                                   
                                            
                    [EMAIL PROTECTED]                                                         
                                            
                                                                                       
                                            
                                                                                       
                                            
                    08/20/01 09:29                                                     
                                            
                    PM                                                                 
                                            
                    Please respond                                                     
                                            
                    to linux-users                                                     
                                            
                                                                                       
                                            
                                                                                       
                                            




On Mon, Aug 20, 2001 at 07:11:49PM -0400, [EMAIL PROTECTED] wrote:
>
> First off, the 192.168.x.x is a reserve address space, which you should
NOT
> be seeing, unless you don't have any registered ip addresses and your
> border router is a 192.168.x.x address as well.
> Secondly, this is multicast traffic, which is pretty selectively allowed.
> Route discovery protocols use this type of traffic, as do some streaming
> technologies.
>
> If you have a registered IP Addy on your firewall's external interface,
> this traffic is most likely spoofed traffic and can be safely discarded
> (with the proper security response)  I would contact the ISP and let them
> know of the issue and ask that it is resolved if they aren't the ones
doing
> it.
> None of these address ranges belong to anyone.  10.x.x.x,
> 172.16.x.x-172.21.x.x, and 192.168.x.x are all reserved address spaces,
for
> use internally in your network.  ISP's should NOT allow packets with this
> source address to ever traverse the Internet.


I am on the @HOME network. I was just told that alhough we appear to have
static ip's they are really dynamic IP's, changed rarely if at all.
I was getting repeated attempts by 10.91.193.1 to offer dynamic ip
assignment, for example. I was told that was a server for @HOME upstream
from me. It may be (JUST WILD
GUESSING) that although we think we are on the internet, we may really be
on
a private network run by @HOME, thus allowing this private IP number to
be used.
Still guessing, this may be some stuff being broadcaste from @HOME central,
for whatever reason. I just block it all.
Joel


_______________________________________________
http://linux.nf -- [EMAIL PROTECTED]
Archives, Subscribe, Unsubscribe, Digest, Etc
->http://linux.nf/mailman/listinfo/linux-users




_______________________________________________
http://linux.nf -- [EMAIL PROTECTED]
Archives, Subscribe, Unsubscribe, Digest, Etc 
->http://linux.nf/mailman/listinfo/linux-users