Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

ip spoof

Posted on 2014-11-26
5
Medium Priority
?
194 Views
Last Modified: 2014-12-02
I just started to see these in our logs

Source       Destination                                  Cisco Event        Result
0.14.2.10    X.X.X.X one of our public IP's 106016             Deny IP spoof

There have been 10 in the last few mins but different source IP's starting with 0.

Excuse my ignorance but what does it mean when the IP address starts from 0.?

Many Thanks!
0
Comment
Question by:Farmerbob212
  • 2
  • 2
5 Comments
 
LVL 84

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 1000 total points
ID: 40468122
0.x.x.x is a reserved block that is not available for public use.  http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml  It belongs to the Internet Assigned Numbers Authority (IANA).
0
 

Author Comment

by:Farmerbob212
ID: 40469097
So if it is a private IP is it coming from within the network? I usually see (inside-network) 192.168.x.x
0
 
LVL 84

Expert Comment

by:Dave Baldwin
ID: 40469510
Yes but 0.14.2.10 is not a 'private IP'.  It is in a reserved block for the Internet Assigned Numbers Authority (IANA) and you should never see it.   I don't know how they are managing to spoof that IP address.  I think it takes some low level programming to do that.
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 1000 total points
ID: 40472468
You can spoof the src with a variety of programs, nmap being one of he easiest, it's already built-in. Spoofing isn't very effective outside of UDP. You should have bogons being denied, that's all of RFC 1918 (10.x.x.x, 192.168.x.x, 172.16.x.x) as well as others you don't want:
http://www.cisco.com/web/about/security/intelligence/firewall-best-practices.html#_Toc332806011
https://supportforums.cisco.com/document/12013356/implementing-anti-spoofing-access-list
It's typically nothing to worry about, especially in the TCP protocol.
-rich
0
 

Author Closing Comment

by:Farmerbob212
ID: 40476237
thank you very much for the advice!
0

Featured Post

Managing Security & Risk at the Speed of Business

Gartner Research VP, Neil McDonald & AlgoSec CTO, Prof. Avishai Wool, discuss the business-driven approach to automated security policy management, its benefits and how to align security policy management with business processes to address today's security challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Still wondering grappling over to strengthen your password, worry no more. Choose a Strong Passphrase instead though second factor is highly recommended. Read on more on the how-to and tips to enhance your "password" using easier to remember passphr…
With more and more companies allowing their employees to work remotely, it begs the question: What are some of the security risks involved with remote employees and what actions should we take to secure them?
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…
Suggested Courses

564 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question