Security

Ask something
Discussion Locked

Possible IP spoofing?

0 helpful
9 replies

by 1networker 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello,

I am a network administrator working in Virginia and I am seeing a small number of packets of IP addresses that don't exist on our network hitting the inside of our firewall where it is then stopped. Both the source and destination addresses are from companies that provide Cable or DSL internet access. We have dial-up access for employees. There are ACL's on the dial-up Cisco routers that only allow only allow traffic that is owned by the network through. Any suggestions as to whythis is happening?
Some ideas have been:
1) Someone is bringing in a comp with the wrong config and trying to put it on the network (seriously doubtful though)
2) Someone is dialing in with a phone modem, but also has NIC card with cable internet access. Somewhere when dialed in, the computer uses the NIC card's IP address and tries to send data over the phone line connection? (this is what we are leaning towards but can't prove it)

Let me know if this is possible or if you have any other suggestions.

Thanks,

Jeff

9 replies

by otto3

I doubt "2)" and "1)" seems like the answer. Some of your users using the same laptops at work and at home. Having DHCP assigned IPs from the cable/dsl companies on the laptop could cause seeing those addresses, when the user connects to your network. Initially the PC will try to keep the IP it has and looks for renewing the lease by broadcasting for a DHCP server. Look in your firewall logs what protocol is used with these foreign IPs.

Otto

by nsa13

Jeff,

Actually, your not too far off track on your 1st suggestion. For example, if you have a user that uses the @Home cable ISP and that service provides a 24.x.x.x address which your firewall is picking up the cause could be the lease durationof the DHCP license.

Let me explain. When a user goes home and they connect to the cable modem the @home service uses DHCP to give them an IP. The IP however is statically assigned by @home. However, instead of going through hell to get a userto understand how to cfg thier box, they use DHCP. If they keep thier laptop on for a few hours and then come to work the next day, its not enough time for the lease (IP/DHCP info) to have expired. So, when they connect to your network the box will automagically try to use the old leased DHCP information. Until of course, the system hits the 50% mark and tries to update the lease. At that time the box will contact a DHCP server and get a proper lease.

On the other hand, when the box first boots up on your network it'll use its old DHCP information to autodiscover its network and to send out its election packet. Once it figures out its on the wrong network it sends out a DHCP packet, gets it, and reverts to the correct settings.

The only other things I can think of is that your router is allowing a pipe in from a @home user and on the return path is being blocked by the router.

..another quick thought. If the @home user has a mapped drive to \\24.x.x.x that'll do it too.=)

GL

Marvin

by x10nd

If someone dials into your network it ought to be directly hitting your network rather than your ISP. Someone ought to be making use of your IP.

by x10nd

If someone dials into your network it ought to be directly hitting your network rather than your ISP. Someone ought to be making use of your IP.

This discussion is closed to new replies.