strange log entry from Cisco PIX

Ok I have one of my PIX boxes dropping logs to a Symantec SIM box which we are doing an eval on.

While scanning through what the SIM presented to me I came across the following log entry which is a bit of a head scratcher:

IP address 0.1.0.4 has directed a denial of service exploit event at 0.1.0.4.


I did some quick googling on that IP address and found RFC 3330, and a few references to people seeing this exact same IP. One of them was in a snort log, the other "big" hit was from someone seeing this IP assigned to a Logitech webcam.

Anyone seen this before? Any ideas what it could be about?

Its most likely the webcam as its the address assigned to the Microsoft TV/Video interface when installing a logitech camera.

well I thought along those lines too, but this is the outside interface that picked it up, not my internal interface. Only happened once, and was listed by the SIM as a "One-Shot DoS".

So how is my ouside interface picking up a non routable IP? Is it just spoofed and someone flubbed up the attack address too?

It is either completely spoofed or your SIM didn't properly decode the log entry. I have seen alot of SIMs that base the outside and inside based on IP addresses, which it would appear that subnet would be external.

I would like to hear the results of your eval. Have you looked at the Cisco MARS box?

It could be off a site to site vpn or maybe even a remote access one........non routeable IP addy's can be 'routed' in an IPsec tunnel........

It's probably not that but thought I would mention it anyways!

Infact thinking of it....thats the only way a not routable IP can reach it, unless the Outside interface is on a [routed] perimeter subnet and not directly connected to the outside world......

This can be confusing in the logs and running config as 'internal' IP's show up on the outside interface.