RE: NetBIOS Messenger spam - how did it get in?

From: Damon McMahon (inst_karma@hotmail.com)
Date: 10/31/02


From: "Damon McMahon" <inst_karma@hotmail.com>
To: feltman@pacbell.net, security-basics@securityfocus.com
Date: Thu, 31 Oct 2002 10:09:33 +1100

Ahhh yes my mistake, mixing up the source and destination addresses.

Of course, this begs the question why internet routers do not filter on
source address, but I'm sure the ISPs have their own self-justifying
reasons...

>
>1. Is this possible? I would have thought any packet
>with such a spoofed IP address would be deemed
>non-routable by any of the routers between the source
>host and mine, and hence would never make it to my host?

>The destination (your external address) is routable. Source is ignored
>unless prohibited. Non-routable addresses are not allowed to be the
>destination on the public Internet.
>
>jef

_________________________________________________________________
Get faster connections -- switch to MSN Internet Access!
http://resourcecenter.msn.com/access/plans/default.asp



Relevant Pages

  • Re: windows explorer
    ... It is trying to access remote port 1027 and local port ... No destination IP address or host name are listed. ... >> Ever since I began cable-modem internet access I get a ...
    (microsoft.public.security)
  • Re: NetBIOS Messenger spam - how did it get in?
    ... this begs the question why internet routers do not filter on ... >>host and mine, and hence would never make it to my host? ... >>The destination is routable. ... >>destination on the public Internet. ...
    (Security-Basics)
  • Re: netfilter iptables and firewall
    ... to access the Internet unless everything is done through an authenticated ... HOWEVER - you should not depend on your firewall ... Temporarily, jack up the logging, so that you are logging all NEW ... Use common scripting tools to sort out source and destination IPs, ...
    (comp.security.firewalls)
  • Re: Lot of blocked traffic attempting to get to 224.0.0.1
    ... > destination IP 224.0.0.1 port 0. ... minutes 5 seconds and hasn't impacted my Internet connection. ... DHCP clients that are running Microsoft Windows 9x/2000 machines. ...
    (comp.security.firewalls)
  • Re: Lot of blocked traffic attempting to get to 224.0.0.1
    ... > destination IP 224.0.0.1 port 0. ... minutes 5 seconds and hasn't impacted my Internet connection. ... DHCP clients that are running Microsoft Windows 9x/2000 machines. ...
    (comp.security.firewalls)