hello,
well Pix is already doing its job and blocking/denying this attack
In order to find out the source of this attack you may set the captures on the firewall and then locate the offending host
Pix(config)#access-list incap permit ip host 127.0.0.1 10.82.239.0 255.255.255.0
Pix(config)#access-list incap permit ip 10.82.239.0 255.255.255.0 host 127.0.0.1
Pix(config)#capture incap access-list incap packet-length 1500 interface WAN
After setting these captures we would like to view the Captures in detail using the command :-
sh capture incap detail
the above command would help us to find out the MAC address of the culprit
using the above MAC address find out the IP address of the host in question
show arp | include 0003.ba71.67ed
inside 10.1.3.16 0003.ba71.67ed
here i assume the MAC to be 0003.ba71.67ed, but in your case it will be different (the one you will capture with the command sh capture incap detail)
Further if you would like to avoid this hitting the firewall then you may block this request on the router downstream to WAN Interface
see if it helps !
