cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
384
Views
0
Helpful
1
Replies

IP Spoof

cyee
Level 1
Level 1

I have recently noticed a bunch of "106016" IP Spoof denials in our PIX log. The characteristic is an attempt to access a host by apparently attempting to impersonate the outside interface IP address.

Are there any measures I can take to try to track down the "perp" or procedures that should be taken to minimize or eliminate this?

1 Reply 1

wraights
Level 1
Level 1

Well...The firewall is doing its job. It is hard to track someone doing that unless you have other "traps" setup at other points, for instance your router.

Sometimes I have noticed that on my network and it ended up being someone within the company trying to do weird things and it looked on the firewall that they were doing spoofing when actually they were just doing something incorrectly.

Does that help? Probably not, but at least you can rest assured that the firewall is protecting your network.