Re: IP spoof messages in firewall logs
- From: "Richard G. Harper" <rgharper@xxxxxxxxx>
- Date: Fri, 18 Nov 2005 16:41:04 -0500
I don't know about a "bug" but I do know that if you have two NICs in the
same address range you will have problems.
--
Richard G. Harper [MVP Shell/User] rgharper@xxxxxxxxx
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm
"Mike C" <Mike C@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:7A742865-EBEF-423F-A892-9A96004BD656@xxxxxxxxxxxxxxxx
> Hi all,
>
> I'm wondering if anyone can help me with this. I'm seeing the following
> message in our SonicWALL logs:
>
> -------------------------
> Alert - Intrusion Prevention - IP spoof dropped - 10.0.0.1, 137, X0 - <IP
> address of WINS server>, 137, X1 - MAC address: <MAC address of primary
> NIC>
> -------------------------
>
> Background info:
> The server is part of a failover cluster. There are two network cards in
> the server. The primary card handles regular network traffic. The
> secondary
> card talks to the partner server's secondary card over a crossover cable
> (addresses are 10.0.0.1 and 10.0.0.2). For the secondary card, only and
> IP
> and subnet mask are specified. No DNS or WINS entries exist.
>
> One of the SonicWALL support documents mentions that "bugs in Windows
> operating systems can cause IP spoofs. The bugs occur when the PC has
> more
> than one network interface installed." Does anyone know of these bugs?
>
> Thanks,
> Mike
.
- Prev by Date: Re: Win2k Remote Desktop Question
- Next by Date: Re: replication failing, dns lookup failure
- Previous by thread: Re: adding a workstation thru vpn
- Next by thread: Re: IP spoof messages in firewall logs
- Index(es):
Relevant Pages
|
