Re: Ip spoof from

From: Pavel Kankovsky (
Date: 11/06/02

From: "Pavel Kankovsky" <>
Date: Wed, 6 Nov 2002 01:34:51 +0100 (CET)

On Mon, 4 Nov 2002, Ingersoll, Jared wrote:

> Nov 1 01:42:44 2U: Nov 01 2002 01:50:32: %PIX-2-106016: Deny IP
> spoof from ( to x.x.x.5

We're seeing them too, since Nov 1 03:30 GMT, approx. 150 per a day.
TCP SYNs to port 445 on different IPs. An interesting detail is that all
of them have IP ID == 256. TTL appears to vary between 108 and 113.

--Pavel Kankovsky aka Peak
"Welcome to the Czech Republic. Bring your own lifeboats."

This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: