Link to home
Start Free TrialLog in
Avatar of yodaa
yodaa

asked on

Land attack dropped sonicwall

Hello Guys

Every few hours I am getting log on sonicwall
Land attack dropped src.  My external IP address and dst. Also with My external IP Src. ZOne WAN

Could you help me with this please?

Thank you
ASKER CERTIFIED SOLUTION
Avatar of John
John
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of arnold
Could it be an internal system trying to access an internal resource by way of the external reference?

not sufficiently familiar with sonicwall to interpret the ....
Avatar of btan
btan

This by default should be what the SonicWall should be doing. So such dropped event indicates that traffic is denied entry into the  SonicWall because it violates configured or default security policies. In specifics to land attack, there is no response returned to the sender or source of the event trigger off by the traffic. The SonciWALL detected and blocked SYN packets whose source IP addresses are spoofed to be the same as the destination IP addresses. This is not supposed to be legit traffic.

Can also check SonicWall Service Objects Security Services under its Intrusion Prevention/IPS Policies. If there is no misconfigurations from the source device causing this triggers than there is something ib the middle causong this instead..it may even be from ISP.
@yodaa - Thanks and I was happy to help.