I did search for info here on AO for IP Spoofing, but I am a bit confused at this point, hence this post. It is a newbie sort of question.

In addition to the normal port scanning I get in my firewall log, I have been getting a huge number of IP Spoof detection off and on for the last three months. The part that has me confused is that the MAC address is one of my ISP's upstream systems, or so the log is leading me to believe. The IP itself resolves to IANA. I really dont think it is likely that IANA or my ISP are trying to IP Spoof me.

Also, the timing is a bit weird. Normally nothing the first seven days or the last seven days of the month. But in between, I get maybe 400 of these attempts every 8 hours. My ISP has been less then helpful. (They actually told me not to worry about it....)

I am using a Sonicwall SOHO3. While all attempts so far have been blocked/logged, I am concerned over the part of the picture I am missing/dont understand.

Thanks for any help you may have,

MrC