On Aug 17, 2007, at 3:31 PM, Miguel wrote:
Hi, i tink im suffering an ip (or mac, im not sure) spoofing attack, my internet link is at 90% and mostly outgoing traffic, im using pf (for nat), so i run pftop and i see a lot of connections from one specific ip address (192.168.206.68), but this address is not assigned to any pc, and it doesnt respond ping either, nmap doesnt report any open port . I see the translations and stablished traffic in pftop and the traffic flow using tcpdump, how can i know what computer is causing this traffic, looking for the mac address in every pc should be the last alternative :-(
Do you have a wireless basestation anywhere? Someone could be borrowing your bandwidth, otherwise, you've probably got a laptop or some hacked machine lying around, which appears to have an Intel NIC in it. :-)
You could try firewalling off all traffic from IP 192.168.206.68 and see whether anyone complains. You could also try looking at switch statistics to locate which port the traffic is coming from, or run tcpdump on the IP and pull cables until you localize the machine.
-- -Chuck _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
