a fake IP

[hanwucisco]

We have a subnet(within public IP addrss) that is drop (into Null0 interface) from our core switch in the Inside network. Therefore pinging it results destnation not reachable. however some company outside in the network compains to us that there is an IP sourced in that droped subnet visits them.

I checked with our Netflow which is also in the Inside zone, yet, there is records of this IP.

is it a fake IP? if so, how can I find the location of the IP?

thanks,

Han

[Julio Carvajal]

Hello Han,

It could be,

Do captures and check the logs of the devices downstream till you get the MAC-address of that host,

Regards

[Jouni Forss]

Hi,

I am not totally sure if I understood the situation correctly but are you saying that you both have this public subnet in your LAN network and there is also a static route towards Null0 for that same network?

If there are actual hosts using public IP addresses from that public subnet then wouldnt this mean that they can still initiate connections anywhere they want but there might be problem with return traffic getting forwarded through to Null0. Unless perhaps the subnet and Null0 route were on the same device and wouldnt the connected network override the Null0 route then?

- Jouni