Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 27 subscribers
  • Views 4764 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Strange "Network Attacks" from IPv6 to IPv4

Casual_User

Hello,

I've noticed these "attacks" listed on the control centre screen for the past couple of days.  It is interesting considering that they do not originate from my LAN and are not directed at my LAN.  The attacks are shown as "SSL Request Export Ciphersuite Detection" coming from an external IPv6 directed to an external IPv4.  The attacks were listed as moderate and the packets were not dropped.  I'm getting about 3 attacks per day.

The "Attacker IP" was: 2001:b031:107:ff00::10

 The "Victim IP" was: 38.4.100.0

I am curious as to:

  1. How did an external IP "attack" another external IP through the XG firewall
  2. How did an IPv6 attack an IPv4.  I would have thought you would have needed to be on the same network.

Thanks.



This thread was automatically locked due to age.
Parents
  • 0
    Hello:
    Today is March 20, 2019, and I have the same problem.
    I do not understand why it is because this happens.
    The attacker is:
    2002:ac00:24e::ac00:24e
    2002:ac00:24e::ac00:243
    2002:ac00:24e::ac00:245
    2002:ac00:24e::ac00:275
    2002:ac00:24e::ac00:277
     
    Any idea?
     
     
    More data from IPV6 address:

    Whois Information

    Source:  whois.arin.net
    Name:  IANA-V6-6TO4
    Handle:  NET6-2002-1
    Registration Date:  Thu Feb 01 05:00:00 UTC 2001
    Name Servers: 

    ASN Information

    ASN:  AS1103
    Country:  NL
    Registration Date:  1993-09-01
    Registrar:  ripencc
    Owner:  SURFNET-NL SURFnet, The Netherlands, NL

    Additional Information

    Expanded Address:  2002:ac00:24e:0:0:0:ac00:243
    Compressed Address:  2002:ac00:24e::ac00:243
Reply
  • 0
    Hello:
    Today is March 20, 2019, and I have the same problem.
    I do not understand why it is because this happens.
    The attacker is:
    2002:ac00:24e::ac00:24e
    2002:ac00:24e::ac00:243
    2002:ac00:24e::ac00:245
    2002:ac00:24e::ac00:275
    2002:ac00:24e::ac00:277
     
    Any idea?
     
     
    More data from IPV6 address:

    Whois Information

    Source:  whois.arin.net
    Name:  IANA-V6-6TO4
    Handle:  NET6-2002-1
    Registration Date:  Thu Feb 01 05:00:00 UTC 2001
    Name Servers: 

    ASN Information

    ASN:  AS1103
    Country:  NL
    Registration Date:  1993-09-01
    Registrar:  ripencc
    Owner:  SURFNET-NL SURFnet, The Netherlands, NL

    Additional Information

    Expanded Address:  2002:ac00:24e:0:0:0:ac00:243
    Compressed Address:  2002:ac00:24e::ac00:243
Children
No Data