jvmorris
I Am The Man Who Was Not There.
Premium,MVM
join:2001-04-03
Reston, VA
| reply to jellybeans27
Re: Norton Internet Security Problem!
Okay, found the earlier thread. It's at »NIS2006 .
Did it look like this? (Probably not, I see that's an outbound attempt and it sounds like you're talking a inbound attempt.)
--
Regards, Joseph V. Morris |
|
jellybeans27
join:2005-10-28
| Here's an example from my activity log:
Details: Intrusion: Invalid Source IP Address.
Intruder: 255.255.255.255.
Risk Level: Medium.
Source IP address: 255.255.255.255.This IP address is invalid.
Destination IP address: YOUR-JSAHFDNCU3(84.13.89.247).
Protocol: ICMP.
|
|
jvmorris
I Am The Man Who Was Not There.
Premium,MVM
join:2001-04-03
Reston, VA | Looks like it's coming from NIS' IDS subsystem, rather than the firewall. Pity it doesn't give more details about the ICMP message involved.
Maybe Reese can shed some light on this.
--
Regards, Joseph V. Morris |
|
ranschultz
Premium
join:2004-05-28
Canyon Country, CA
 ·Vonage
1 edit | reply to jellybeans27
This appears to be a smurf type of attack. Somebody on your local segment is sending this packet with the intent of using your machine to amplify the attack and cause a denial of service to your segment or some machine on your segment.
To figure out who it is you'd have to use a packet sniffer to get the ethernet address associated with the offending packet and associate that with an Internet address. Reporting the ethernet address alone to your ISP should be sufficient to track this person down.
Edit: fixed a bone-headed wording mistake. |
|
jellybeans27
join:2005-10-28 | Which 'packet sniffer' do you recommend? |
|
