Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 27 subscribers
  • Views 9912 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IP spoof question

brock eldridge

I have IP spoofing enabled.

In the logs it shows a lot of the same address from source and destination addresses.

Is this normal ? It's an 169.254.x.x address from source.

Thank you

Brock



This thread was automatically locked due to age.
Parents
  • 0

    brock,

    can you share the logs and the DOS & IP Spoofing?

    Thanks

  • 0 in reply to lferrara

    Here are some logs

     

     

    2017-05-17 07:39:08
    IP Spoof
    Denied
    -
    0
    -
    -
    169.254.7.171 :UDP (42388)
    169.254.255.255 :UDP (42388)

     

    05151
    Open PCAP
    2017-05-17 07:39:07
    IP Spoof
    Denied
    -
    0
    -
    -
    169.254.7.63 :UDP (42388)
    169.254.255.255 :UDP (42388)

     

    05151
    Open PCAP
    2017-05-17 07:39:07
    IP Spoof
    Denied
    -
    0
    -
    -
    169.254.7.63 :UDP (42388)
    169.254.255.255 :UDP (42388)

     

    05151
    Open PCAP
    2017-05-17 07:39:07
    IP Spoof
    Denied
    -
    0
    -
    -
    169.254.7.63 :UDP (42388)
    169.254.255.255 :UDP (42388)

     

    05151
     
     
     
     and spoof is just enabled on the lan side. I followed a Sophos KB
     
     
     
Reply
  • 0 in reply to lferrara

    Here are some logs

     

     

    2017-05-17 07:39:08
    IP Spoof
    Denied
    -
    0
    -
    -
    169.254.7.171 :UDP (42388)
    169.254.255.255 :UDP (42388)

     

    05151
    Open PCAP
    2017-05-17 07:39:07
    IP Spoof
    Denied
    -
    0
    -
    -
    169.254.7.63 :UDP (42388)
    169.254.255.255 :UDP (42388)

     

    05151
    Open PCAP
    2017-05-17 07:39:07
    IP Spoof
    Denied
    -
    0
    -
    -
    169.254.7.63 :UDP (42388)
    169.254.255.255 :UDP (42388)

     

    05151
    Open PCAP
    2017-05-17 07:39:07
    IP Spoof
    Denied
    -
    0
    -
    -
    169.254.7.63 :UDP (42388)
    169.254.255.255 :UDP (42388)

     

    05151
     
     
     
     and spoof is just enabled on the lan side. I followed a Sophos KB
     
     
     
Children