?
Solved

IP Spoofing, Back Orifice, Sub Seven, Netbus

Posted on 2000-05-04
3
Medium Priority
?
473 Views
Last Modified: 2010-04-11
I have a sonicwall pro firewall on my LAN which keeps sending me alerts to warn me of various attacks, it started about a month ago with the sub seven attacks then came the netbus and back orifice and now I am getting 70-80 alerts a day to say that an IP spoof has been detected but the IP address is that of my own workstation. Why is this happening and how do I stop it!??
0
Comment
Question by:1524
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 63

Expert Comment

by:SysExpert
ID: 2778014
That's what spoofing is. It puts a local address in a packet, so that it can get into your network.
I do not think there is much you can do since this is all coming from the outside !!
The only other thing is to run a good virus detector with updated virus definitions to make sure your machine is clean !!

I hope this helps !
0
 
LVL 3

Accepted Solution

by:
apadua earned 1245 total points
ID: 2780404
The idea in IP spoofing is exactly that. Someone will start sending commands with a mal-formed packed, containing the IP address of the internal network as the source address. The concept is interesting, because usually boxes on the inside of the network have more rights than ones on the outside. And usually, the IP address is what is used to detect these rights. Simple firewalls and routers don't check which interface the packet came from. Hence, even if your packet came from the public interface, the IP is of a trusted machine, so arbitrary code could be executed. It's hard to use an attack such as this one, but great for spoofing, say, snmp.

However, you could be getting IP spoofing messages because your machine is configured incorrectly. You could have the wrong default mask, the wrong IP range, or wrong Default Gateway. Check these three things before you get any more worried. Also, check to see if these attacks go on even if your machine is turned off. (Or maybe ONLY when your machine is turned off).

Try to relate things. Best way to find these types of problems (assuming you aren't really being hacked).

Cheers,

Andre
0
 

Author Comment

by:1524
ID: 2780452
THANKS
0

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question