Logs show spoof

I am currently running a Sonicwall firewall and have over the past week recieved a few IP Spoof detected warnings. The warning shows an IP address that could be on my subnet, but falls outside my current scope. The warning gives me a MAC address as well, and though the spoof seems to come from different IP addresses each time, the MAC remains the same. I am fairly new in the security realm and really have no idea what this warning means or if some one is actaully attempting illicit activity.

Off topic - I am also getting pinged 4-5 times per minute from addressed fairly similar to my public IP. I have called the ISP with ni results. I am thinking this is a product of the Blaster worm. Anyone else seeing this type of traffic.

Thanks for any info provided.

AFAIK Blaster doesn't spoof it's source and/or tries to ping it's (potential) victims.

Is your firewall connected to some sort of dialup (this usually includes xDSL, pptp and vpn connections)? If so, the MAC is probably bogus too.

I can only suggest blocking all private adresses originating on the outside interface. This means setting up 1 or more rules that block packets using RFC1918 addresses (and a couple more) as a source.

Tracing a spoofed source is next to impossible without the help of all the ISPs and Telcos that are between you and your 'attacker'.

The19: You can use something like Ethereal to capture the packets. This will tell you what kind of adapter the MAC address is coming from or try putting the first three octets of the address in one of these sites and see if you can ID the device. If it is a Cisco, Bay or whatever then the packets are being spoofed from outside your collision domain, (local network). If they come from something else then the probability is higher that it is a machine on your network.


The pings are the other worm that fixes MSBlast, (I forget it's name), as long as your firewall block port 135 inbound you should be fine.

Quote:

---

Originally posted here by the19man
[B]I am currently running a Sonicwall firewall and have over the past week recieved a few IP Spoof detected warnings.

---

How does it determine that the packets have spoofed source addresses?

Quote:

---

The warning shows an IP address that could be on my subnet, but falls outside my current scope. The warning gives me a MAC address as well,

---

As MAC addresses are not part of the IP packet, they cannot have come across the internet. The MAC address will be a machine on your LAN. Either that is the box that did the spoofing, or (more likely) it is a router which has routed it to your LAN.

Quote:

---

and though the spoof seems to come from different IP addresses each time, the MAC remains the same.

---

As I say, MAC is not part of an IP packet. Therefore it isn't routed. So the MAC probably belongs to your router.

Quote:

---

I am fairly new in the security realm and really have no idea what this warning means or if some one is actaully attempting illicit activity.

---

Well probably not.

I doubt whether the packets are spoofed at all - I expect it's a false alarm.

It is unusual to see and difficult to detect spoofed packets. Fortunately they aren't much of a risk because an attacker can never get responses to them.

But they have been used for UDP-based DoS in the past.

Slarty

the19man

Im experiencing the same exact thing as you are for the last 3 days....

My Firewall (Zonealarm) reports them as ICMP request, however when I sniff the packets
they are a bunch of ARP requests...and just as you stated the dst MAC address is the same
(as probably expected).

MAC address is also same as my default gateway..( you might want to ping your default gateway and check arp table to verify as well,,on windows OS type arp -a)

I also assumed packets were spoofed because I could not ping any of src addresses and just like you described, the src addresses are in the range of my own. (although this is not 100% accurate assumption)

My protocol analyzer reports upwards of 1000 ARP requests per minute and sometimes higher..
captured trace and sent to my ISP (cable modem)...awaiting their analysis (wont hold my breath)


Ill keep ypu posted...

cheers

P.S
Oh I forgot to add, I physicaly changed my NIC card (which changed my IP) to make sure no one was homing in on me. However problem persisted,,I guess it is a random occurance..

Quote:

---

My Firewall (Zonealarm) reports them as ICMP request, however when I sniff the packets
they are a bunch of ARP requests...and just as you stated the dst MAC address is the same
(as probably expected).

---

This does not make sense:

1. ARP packets are not ICMP packets.
2. ARP packets only exist on ethernet LANs and are not routeable
3. ARP request packets are usually broadcast. Therefore the destination MAC is going to be ff:ff:ff:ff:ff:ff

Something is wrong here. One of your tools is showing up normal traffic as intrusion.

Slarty

Slarty:
I think he's misreading the dumps. What he is seeing is the ARP "Who Has" for each subsequent Ping. When the infected machine realizes from the subnet mask that the address is local it will queue the ARP requests and broadcast them.... He will see them all and if he looks through them there will be one that refers to his IP and a reply from his with the MAC address.

The log is probably showing a flood of ARP requests and a series of ICMP and he is combining them as a single entity rather then dividing them for what they are.

slarty - thanks for breakin it down.


Thanks to others for feedback and input. I appreciate the sharing of knowledge.

Slarty,

Let me make myself clearer..Should have been more specific with my findings..

ARP packets ofcourse are not ICMP packet. These can be two different incidents occuring at same time..(what Zonealarm is reporting and what protocol analyzer is capturing may not be related..the # of ARP captures is no where near the # of Zonealarm incidents) I used 3 different protocol analyzers and are all reporting same captures..Ethereal, Network General Sniffer (original DOS version) and Snifferpro..The ARP packets are Im sure for a fact is what they are.

And yes ARP packets do exist only on LANS and are not routable (unless you had proxy arp turned on routers and was able to force PC to send ARP request for different subnet than your own..wont get into it here,,can easily be done) anyway thats not the point here,,With cable service, your connection is on same VLAN/ broadcast domain as others in same neighborhood/community.

Think of the following:
(PC1, PC2, PCx and Ethernet of router are all on same VLAN/broadcast domain)

PC1--------------->
subnet 1
PC2---------------> all going to 1 router/1 NIC with multiple IP addresses (secondary addresses)
subnet 2
PCx--------------->
subnet x

Ive set this up many times (although only in switch environments)
Its no different than 2 PCs with diff subnets on same hub going to one router with primary and secondary Ip addresses.. Each PC has its own default gateway wich happens to be same MAC/physical NIC. and the important thing to see here is when PC1 send a broadcast, PC2 will hear it...

And I didnt make myself clear about MAC address,, I was referring not to dst MAC of ARP request,,sure thats FFFFFFFF, I was referring to src where it happens to be same unicast..,,,
The above examples clearly demonstrates this..


Cheers..

P.S.
With all do respect Tiger Shark, I know Iam a newbie here at AO, but not to "toot"
my own horn,,very experienced and senior when it comes to routing/switching/IP and utilizing protocol analyzers....(hope that didnt sound arrogant,,just stating fact)

Hey Gunit.... No problem..... just trying to help...... It's sometimes really hard to determine someone's skill level based on reading one or two of their posts....... Didn't mean to come across as a know-it-all...... It just seemed to me that it might be plausible for someone to have done that with such a large amount of traffic and the output can be a tad overwhelming.... My apologies if I offended...... :o

None taken...I always love a good discussion as long as we all benefit form end results..

Cheers..
:)

i'm buddies with the19man and he mentioned i might want to tack my spoof issue onto this thread.

i'm also running a sonicwall firewall. for the past week i have been getting ip spoof detections in my firewall log. the source ip claims to be from my lan but does not fall into any of my subnets - not even close. the mac address that is listed is from an ethernet port on my internal cisco router that provides the connection to the sonicwall firewall.

i know very little about how these things work, but does this mean that something on the inside of my firewall is causing the spoof entries? any help would be appreciated. the ip spoofs are detected roughly every 20 minutes. the source network always a 172.x.x.x address. as far as i know nothing has changed in the configuration of my network.

thanks in advance for your help!

cooderbuck,

Is this your topology (can you verify please and answer a few questions to help better understand what is happening. The firewall could be reporting whats referred to as "false positives" depending on setup of firewall) But anyway lets not assume that yet,,Take a look at the following setups and see if either matches yours:

(fig a)

||PC||------------||FW||------------||ROUTER||------------------Internet

or

(fig b)

||PC||------------||Router||------------||FW||------------------Internet


and could you answer the following questions please:

1) Are you using cable, DSL, etc..for internet access?
2) Do you mind telling us the 2nd octet( just the 1st # following the 172) of the 172 address.
curious to see if its part of a private block reserved for private use or a public address?
3) Just out of curioisity, Ive worked extensively with Cisco routers, what model is it?
4) Are there more than one PC on your network,,,If so,can you describe where abouts..


Cheers

:)

I'm currently setup like figure b with the addition of a router on the "outside" of my firewall that maintains the connection to my ISP.

I'm connected via a full T1 to our ISP through a 1720 router. The ethernet port on this router connects to the WAN port on the firewall. The LAN port on the firewall connects to an ethernet port on a 2611 router. The 2611 has two addition T1 cards that connect our branch offices. The other ethernet port on the 2611 acts as the gateway for the local network and is connected to my main switch in the corporate office.

The current source IP address of the spoof is 172.153.x.x. It changes every day or so, but every time I check it belongs to a block that AOL owns - I think...

Just so you have the full picture... The 2611 acts as the main hub for the network. It connects to my corporate office via an ethernet port. My two branch offices are tied in via the T1 cards and have 1604Rs at the other end.

The corporate office has several servers and 30 or so workstations using dhcp and a private address range with the internal ethernet of the 2611 as thier gateway. The branch offices have a server each and several workstations using dhcp and private address range with the ethernet of the 1604Rs as thier gateway.

The 2611 routes all traffic from the various internal interfaces to the firewall. The firewall is using NAT. The firewall has a public IP address on the WAN port that connects to the 1720, which has another public IP in the same subnet - no NAT.

This setup has been working well for a couple years now. The IP spoof is recent, but bothers me because it is so consistent. Hope this wasn't too much information and thanks again for your help.

cooderbuck,

I totally understand your setup...Its very clear..and straight forward..

The only thing I would like to ask is about your private addressing assignments:
You dont have to give out specifics (although it really doesnt matter, not routable)

Anyway are:

a) your internal private IP addresses part of one of the following blocks:
10.x.x.x
172.16.x.x---172.31.x.x
192.168.x.x

and

b) Is your internet traffic strictly initiated from inside or both ways for example are you hosting any web servers, DNS, SMTP/POP3 etc...)

See, I havent worked with Sonic particularily, but for the Firewall to detect spoofed addresses, It is detecting (this is my guess) one of two things:

1) Some one is actually sending spoofed packets from the Internet with src address that of RFC1918 (which are part of private address range I listed above)

or

2) You are not using private IP addresses on private internal network, and the Firewall sees the internal src IP matches the range of some of the websites your users go to (like maybe AOL's)


This is the best guess I can make unless others can shed some light on topic..

Good Luck

Cheers..
:)

My internal private addresses are all 192.168.x.x. I have a one to one nat mapping in the firewall from a public address to a specific internal address to handle email. That is, I receive smtp traffic that is sent to one of my public addresses and that gets routed to my smtp gateway via the mapping - which, right now is internal. I am also using OWA, so there is some http/https traffic that is initiated from the outside.

I can rule out 2) in your last post, so if 1) is the case, do I have anything to worry about? I don't think this is causing any other problem than filling up my logs a bit more frequently, but if there is a way for me to make it go away, I'd like to figure it out.

Thanks again for your comments!

P.S.
Idont know how critical your data or line of business is,,however, ( playing the devil's advocate) Ild like to advise you to be prepared for the worse that can happen..This means make sure you have right tool/s and not just firewall (alot of great threads tutorials are written on subject.) and skilled IT staff to support and secure the network. In my line of business you would be surprised how often companys mismanage and often neglect the importance of having and enforcing a security policy...

Anyway , also if you have lthe icense for it, you can install the Cisco Firewall feature set IOS on your 2611 thats got a basic IDS module (not full package w/ all signatures, but better than anything) to add another layer of security...Although Im sure there are alot of freebies out there that are equal to if not better....(no flames!!!)


(sorry you beat me to it,,this comment was supposed to be appended to previous response)