A land attack is a remote denial-of-service (DOS) attack caused by sending a packet to a machine with the source host/port the same as the destination host/port.
With that said, to find the source mac of this attack we really need to capture on the interfaces on the PIX.
access-l test permit ip host 21.1.139.116 any
access-l test permit ip any host 21.1.139.116
cap capin access-l test int inside
cap capout access-l test int outside
When the problem happens you need to apply these captures and find the source mac for these attack packets.
If you are unsure or or not comfortable with these commands, it is better to open a tac case.
to clear captures and collect fresh packets you can do
clear cap capin
clear cap capout
to remove them completely issue
no cap capin
no cap capout
Good luck.
