topic Re: Deny IP spoof from (127.0.0.1) in Network Security

Deny IP spoof from (127.0.0.1)

sysadmin — Mon, 11 Mar 2019 17:40:24 GMT

Greetings!

I have recently began to receive these errors on my ASA 5510. I've done a debug when it occurs but haven't noticed an unusual traffic coming from the internal or external network.

here's the error:

2|May 03 2010|12:04:08|106016|||||Deny IP spoof from (127.0.0.1) to OUR_EXT_IP on interface outside

based on the message. should I be looking on the inside or outside of my fw? This is really the first time i've seen these messages so i'm sorta green to them.

if you need more logs, let me know and i can provide here. thanks for the help!

Re: Deny IP spoof from (127.0.0.1)

Jennifer Halim — Tue, 04 May 2010 03:19:12 GMT

This is what syslog# 106016 means for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4768961

And the traffic is coming from the outside interface/external to your network.

Re: Deny IP spoof from (127.0.0.1)

astripat — Tue, 04 May 2010 12:47:59 GMT

Hi,

It could be a virus attack or it could be that someone is trying to compromise the network by sending traffic using a soofed ip address. The best way would be take sniffer so that you could see the MAC address of the faulty machine/source.

Also, if you want to disable this log message, you can do that as well, as follows:

no logging message 106016

HTH

Ashu

Re: Deny IP spoof from (127.0.0.1)

sysadmin — Tue, 04 May 2010 14:22:42 GMT

thank you both for the answers.

i figured for sure it was coming form the outside but like i said, the debug wasn't very helpful when i was looking at it.

i'll setup a mirror port on my stack for the outside and see if i can catch it. thanks again, you've given me a great staring point.