Sounds like you have a machine that belongs on the PRO network that is plugged into the PSN hub, a machine on the PSN that thinks it has an address that belongs on the PRO, or a Windows host that is dual-homed (has connections to both networks).
Windows hosts that are dual-homed seem to *always* send traffic out the wrong interface. Come on, Bill, it's not *that* hard to figure out which interface matches the IP you're sending from! Mike Burden Lynk Systems http://www.lynk.com (616)532-4985 [EMAIL PROTECTED] > -----Original Message----- > From: Randy Haley [mailto:[EMAIL PROTECTED]] > Sent: Friday, December 20, 2002 11:08 AM > To: [EMAIL PROTECTED] > Subject: [gb-users] Many many log entries > > > My gnatbox is created hundreds of log entries with the following: > > > 2002-12-20 > 08:21:57,0,4,63.X.X.X,UDP,10.10.40.2,137,10.10.20.4,137,FILTER: > Possible spoof; return interface dc1 doesn't match arrival interface: > warning UDP [10.10.40.2:137]->[10.10.20.4:137] dc3 l=50 > 2002-12-20 > 08:21:57,0,4,63.X.X.X,UDP,10.10.40.2,137,10.10.20.4,137,FILTER: > Possible spoof; return interface dc1 doesn't match arrival interface: > warning UDP [10.10.40.2:137]->[10.10.20.4:137] dc3 l=50 > > dc1 is our Protected network > dc3 is our PSN > > 10.10.40.2 is a ip address on our protected network. > 10.10.20.3 is also on our protected network. > > If I am reading this right, the gnatbox is saying that a > request came from > 10.10.40.2 to 10.10.20.4 via dc3 (PSN) and the gnatbox > returned it to dc1 > (Protected). Is this right? > > If so, is this saying that a machine on my PSN with an ip > address 10.10.40.2 > attempted to access a server on my PROTECTED interface? > > Any help would be appreciated. > > Thank You, > Randy Haley > ETBU > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [EMAIL PROTECTED] > To subscribe to the digest version first unsubscribe, then > e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > Archive of the last 1000 messages: > http://www.mail-archive.com/[email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] To subscribe to the digest version first unsubscribe, then e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] Archive of the last 1000 messages: http://www.mail-archive.com/[email protected]
