I am getting the following in the error log of a customers GB-500 Aug 20 12:23:10 pri=4 flt_action=block count=1 msg="Possible spoof, return interface doesn't match arrival interface" proto=80/tcp src=9.171.204.145 srcport=4651 dst=66.254.105.3 dstport=80 interface=r10 attribute=alarm flags=0x2
I have tons (and I mean TONS) of these the src ip is changing and the dst ip goes between 66.254.105.3, .5, .1 And none of these are ip's that my customer is using not even in the same or close to same subnet. Any thoughts on how to clean this up? Thanks Steve ------------------------------------------------------ To unsubscribe: [EMAIL PROTECTED] For additional commands: [EMAIL PROTECTED] Archive: http://archives.gnatbox.com/gb-users/
