IP Land Attack

Posted on 2006-06-07
Last Modified: 2012-05-05
Our PIX has been logging this message for the past three days almost every minute.

<162>Jun 07 2006 10:11:11: %PIX-2-106017: Deny IP due to Land Attack from to

Is there any way to determine where this is comming from?  I understand that the PIX is blocking the threat, but I am concerned it is also wasting resources dealing with these constantly too.

Question by:leerlp
    LVL 9

    Accepted Solution

    Hi there,

    This indicates a potential LAND attack  (DOS attack), you should double check this issue with your service provider to determine exactly where the attack is coming from.

    Hope this helps!
    LVL 32

    Assisted Solution

    It could well be a land attack and you should ideally be checking your network for any infected machine. IP Spoofing is one of the very very difficult thing to identify and only security measures can be taken. It has been noted recently that XP SP2 machines with Microsoft Firewall disabled are vulnerable to this. So you can take these steps;

    1. Install a sniffer like Ethereal and scan your network 'segment by segment' to see from which area you are getting this and make sure that all the machines are updated with all security updates.

    2. Turn on the Firewall (Desktop) for all the machines.

    Since you haven't mentioned your network topology, this might not be only coming from the segment attached to PIX but can also happen in other segments separated by routers.

    LVL 1

    Expert Comment

    i am also having this error but cannot seem to find any info can someone please help me out.  I have used wireshark but the ip address does not exist so i am not sure where it is coming from  (

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Maximize Your Threat Intelligence Reporting

    Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

    Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
    This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
    how to add IIS SMTP to handle application/Scanner relays into office 365.

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    12 Experts available now in Live!

    Get 1:1 Help Now