Diana,
Since this packet is coming from your inside network:
1) Sniff the inside LAN segment and find the MAC address
associated with the offending packet. It will either be from the
originating station or from a router forwarding the packet from
another segment.
2) If the packet is from another segment, repeat step 1 as needed
until you find the originating stations MAC address.
If you have a switched network, correlating switch ports to MAC
addresses should be easy. If not, you will have to visit each non-
switched station to find the MAC address. (unless you have very
good, up to date documentation on the MAC addresses in use in
your network.)
Good luck,
Kent
> Date: Wed, 28 Feb 2001 18:54:00 -0800
> From: [EMAIL PROTECTED]
> Subject: IP spoof
>
> Can someone please tell me how to go about finding the offending
> device that is generating this error?
>
> %PIX-2-106016: Deny IP spoof from (0.0.0.0) to 12.25.198.83 on
> interface inside Thanks. Diana
>
>
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
