Sophos Firewall

Discussions IP spoof question

Sophos Firewall requires membership for participation - click to join

Thread Info

State Not Answered
Locked Locked
Replies 4 replies
Subscribers 27 subscribers
Views 9912 views
Users 0 members are here

Options

Suggested

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IP spoof question

brock eldridge over 8 years ago

I have IP spoofing enabled.

In the logs it shows a lot of the same address from source and destination addresses.

Is this normal ? It's an 169.254.x.x address from source.

Thank you

Brock

This thread was automatically locked due to age.

Parents

0 lferrara over 8 years ago

brock,

can you share the logs and the DOS & IP Spoofing?

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 brock eldridge over 8 years ago in reply to lferrara

Here are some logs

2017-05-17 07:39:08

IP Spoof

Denied

-

0

-

-

169.254.7.171 :UDP (42388)

169.254.255.255 :UDP (42388)

05151

Open PCAP

2017-05-17 07:39:07

IP Spoof

Denied

-

0

-

-

169.254.7.63 :UDP (42388)

169.254.255.255 :UDP (42388)

05151

Open PCAP

2017-05-17 07:39:07

IP Spoof

Denied

-

0

-

-

169.254.7.63 :UDP (42388)

169.254.255.255 :UDP (42388)

05151

Open PCAP

2017-05-17 07:39:07

IP Spoof

Denied

-

0

-

-

169.254.7.63 :UDP (42388)

169.254.255.255 :UDP (42388)

05151

and spoof is just enabled on the lan side. I followed a Sophos KB
Cancel
Vote Up 0 Vote Down

Cancel
0 Muhammad Osama over 8 years ago in reply to brock eldridge

It looks like some computers on your LAN are not getting a proper IP address via dhcp. The 169.254.0.0/16 range is the automatic private IP addressing range through which dhcp clients self-assign themselves IP addresses when a DHCP server is not available.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Muhammad Osama over 8 years ago in reply to brock eldridge

It looks like some computers on your LAN are not getting a proper IP address via dhcp. The 169.254.0.0/16 range is the automatic private IP addressing range through which dhcp clients self-assign themselves IP addresses when a DHCP server is not available.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 brock eldridge over 8 years ago in reply to Muhammad Osama

Hello

How would I find the out what device is causing this issue? Right now all computers and printers are functioning like they should be.
Cancel
Vote Up 0 Vote Down

Cancel