Spoof Attack

[AngelicKnight]

I was checking my SonicWall log, and this turned up:

05/03/2004 18:07:28.048 FTP: PASV response spoof attack dropped
Source: 192.165.218.22, 21, WAN
Destination: 192.168.1.33, 3443, LAN

So what appears to be going on here? Is someone trying to spoof me?

[cacosapo]

is just ur firewall alerting u that an attack was detect and defeated. i advise u to ignore, since there are tons of attacks per second and its is impossible to seek out each one (except maybe is it is reocurring)

[Info Tech Geek]

Here is a great resource. Should answer all of your questions.

http://www.sonicwall.com/services/pd...events_ref.pdf

*IP Spoof Detected - A packet with a source IP address and arriving at an interface that conflicts with the SonicWALL route table was detected and rejected by the SonicWALL.

[KorpDeath]

Don't fret unless you can put it together with other attacks, false positives are a dime a dozen.

[KorpDeath]

Don't fret unless you can put it together with other attacks, false positives are a dime a dozen.

[AngelicKnight]

Thanks InfoTech, that's exactly what I needed.

Well, it turns out it was our other tech guru who was the FTP that was blocked out, so all is well. That was a good lesson in log analysis nonetheless.

[AngelicKnight]

Thanks InfoTech, that's exactly what I needed.

Well, it turns out it was our other tech guru who was the FTP that was blocked out, so all is well. That was a good lesson in log analysis nonetheless.