IP Source Spoofing signature?

[jnlawrence76]

I am trying to find a signature that will tell my IPS to notify me when it sees any IP source address come from the network behind my IPS that was not in that subnet range.  Is there an existing signature I may have looked over in my IPS or has anyone created a custom IPS signature I can use?

[mzeiser]

Hi Jeremy

We can't really release a generic "Spoof" signature since it depends on the network you're on what's a spoof and what not. That being said, signature 1104-0 may be of interest to you. Have a look, and maybe clone and edit it for your needs.

Martin

IPS Signature Team