topic Re: Syslog ASA-2-106017 - Land Attack in Network Security

Syslog ASA-2-106017 - Land Attack

highmiles2 — Mon, 11 Mar 2019 14:43:59 GMT

I came across this syslog message while troubleshooting an access issue and real-time log viewing. This syslog message looks serious, but how and what do you do?

Syslog ASA-2-106017 : Deny IP due to Land Attack from IP_address to IP_address.

The land attack lists the IP addresses to be my outside global address. That is the address I use for internet traffic!

Not sure how to treat this issue?

Thanks,

Re: Syslog ASA-2-106017 - Land Attack

Syed Iftekhar Ahmed — Fri, 30 Jan 2009 08:58:28 GMT

This message appears when you have enabled Unicast RPF.

Even though an attack is in progress, if this feature is enabled, no

user action is required. The Cisco ASA repels the attack.

Syed

Re: Syslog ASA-2-106017 - Land Attack

highmiles2 — Fri, 30 Jan 2009 15:04:43 GMT

Hi Syed,

I did not enable Unicast RPF.

Is this feature enabled by default?

How does the ASA repel the attack?

Any recommended reading about this on Cisco?

Thanks,

Suhail

Re: Syslog ASA-2-106017 - Land Attack

amarula115 — Sat, 31 Jan 2009 02:51:11 GMT

I have the same issue on my ASA just source and destination IP are 0.0.0.0 0.0.0.0

I posted this issue here and got reply from someone with the following explenation:

"Somebody has released a program, known as land.c, which can be used to launch denial of service attacks against various TCP implementations. The program sends a TCP SYN packet (a connection initiation), giving the target host's address as both source and destination, and using the same port on the target host as both source and destination."

You can read about land.c on Cisco web:

http://www.cisco.com/en/US/products/products_security_advisory09186a00800b1693.shtml">http://www.cisco.com/en/US/products/products_security_advisory09186a00800b1693.shtml

Re: Syslog ASA-2-106017 - Land Attack

highmiles2 — Mon, 09 Feb 2009 20:01:26 GMT

...i checked the advisory, and it is 12 years old.....that is way too old....