Outside traffic not destined for my outside address showing up in ASDM Syslog

[Ken D]

Hi everybody! This may be a silly question but would there be a reason why I would be getting traffic on my outside interface that has a destination address which is not my assigned outside address? I recently set up my ASA 5505 on the network and gave it an available outside address of say 192.x.x.250 on interface vlan 100. When I assign vlan 100 to e0/0 and bring the port up, I start seeing lots of traffic pour into the ASDM Syslog with various destinations belonging to my subnet but that are not actually destined for my specific outside address of 192.x.x.250.

They are showing a destination of say 192.x.x.85 or 192.x.x.29.

Any thoughts as to how and why this is happening/possible?

Thanks in advance!!!!

[Shrikant Sundaresh]

Hi Ken,

If you could provide the sylogs over here, then we could try to narrow out why exactly it is happening.

I can think of two reasons for now:

1. ARP requests. The MAC address for a ARP request would be the broadcast MAC address, and thus would reach all machines on the same subnet.

2. The ASA might have an incorrect nat configuration, which causes it to PROXY ARP for all ips in the subnet.

Thus sometimes, the other devices get the ASA's ARP reply instead of the actual device. Thus the traffic comes to the ASA instead of the actual device.

However, I can't be sure why its happening, unless I have a look at the syslogs.

-Shrikant

P.S.: Please mark the question as answered if it has been resolved. Do rate helpful posts. Thanks.

[Ken D]

Hi Shrikant, thanks for replying and sorry disappearing like that!! Got overwhelmed with other projects here. Anyhoo, did you want me to just do a data dump of the traffic for you to check out or is there other info you want?

To give a little more detail as to what is going on, most of the traffic that I am receiving are TCP SYN and SYN/ACK packets primarily to port 445 which I know is probably just some evil scanner out there. I have since removed any NAT/PAT settings and routes so at this point I basically have my ASA with Outside and Inside interfaces configured with their respective IP's and have them up. With this configuration I can still see the traffic pour into the ASDM even when it's not addressed to my outside interface.

Thanks again for all your help!

-Ken

[Ken D]

Small traffic dump attached.