Could be a modem, but it's most likely a laptop from someone else's
network. Any vendors/servicepeople/partners/friends on site that day? It's
not likely to be an intrusion, unless physical.
Jack Coates, Rainfinity SE
t: 650-962-5301 m: 650-280-4376
On Thu, 22 Jun 2000, Karim Amrani wrote:
> Hi everybody,
>
> We have a FW1 v4.1 running on a Ultra 5 box (Solaris 2.6). The
> configuration is classic :
> Internal LAN -> qfe0
> DMZ -> qfe1
> Internet -> hme0
>
> The internal LAN addresses are 192.168.something and the anti-spoofing
> is on.
>
> The problem is that I had an alert saying that some valid address (not
> one of ours) has been detected on the internal LAN (Antispoof alert).
> This valid address is resolved into an public ISP client.
>
> Where can this come from ? I forbid the use of modems on the LAN (could
> this be it anyway ?). Could this be a successful intrusion into our
> systems ?
>
> How can I track that ? I looked at the arp table but I could not find
> the alien address in the table (too late ?).
>
> Any help appreciated a lot,
> Karim AMRANI
>
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
