Solved

ip spoof

Posted on 2014-11-26
5
174 Views
Last Modified: 2014-12-02
I just started to see these in our logs

Source       Destination                                  Cisco Event        Result
0.14.2.10    X.X.X.X one of our public IP's 106016             Deny IP spoof

There have been 10 in the last few mins but different source IP's starting with 0.

Excuse my ignorance but what does it mean when the IP address starts from 0.?

Many Thanks!
0
Comment
Question by:Farmerbob212
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 250 total points
ID: 40468122
0.x.x.x is a reserved block that is not available for public use.  http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml  It belongs to the Internet Assigned Numbers Authority (IANA).
0
 

Author Comment

by:Farmerbob212
ID: 40469097
So if it is a private IP is it coming from within the network? I usually see (inside-network) 192.168.x.x
0
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 40469510
Yes but 0.14.2.10 is not a 'private IP'.  It is in a reserved block for the Internet Assigned Numbers Authority (IANA) and you should never see it.   I don't know how they are managing to spoof that IP address.  I think it takes some low level programming to do that.
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 250 total points
ID: 40472468
You can spoof the src with a variety of programs, nmap being one of he easiest, it's already built-in. Spoofing isn't very effective outside of UDP. You should have bogons being denied, that's all of RFC 1918 (10.x.x.x, 192.168.x.x, 172.16.x.x) as well as others you don't want:
http://www.cisco.com/web/about/security/intelligence/firewall-best-practices.html#_Toc332806011
https://supportforums.cisco.com/document/12013356/implementing-anti-spoofing-access-list
It's typically nothing to worry about, especially in the TCP protocol.
-rich
0
 

Author Closing Comment

by:Farmerbob212
ID: 40476237
thank you very much for the advice!
0

Featured Post

Now Available: Firebox Cloud for AWS and FireboxV

Firebox Cloud brings the protection of WatchGuard’s leading Firebox UTM appliances to public cloud environments. It enables organizations to extend their security perimeter to protect business-critical assets in Amazon Web Services (AWS).

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Ransomware continues to grow in reach and sophistication, putting data everywhere at risk. Learn how to avoid being caught in its sinister clutches with these 11 key tips.
No single Antivirus application (despite claims by manufacturers) will catch or protect you from all Virus / Malware or Spyware threats. That doesn't stop you from further protecting yourself however - and this article is to show you how.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question