Skip to main content
Anonymous_User
Contributor III
March 16, 2004
Question

IP Spoofing

  • March 16, 2004
  • 5 replies
  • 12734 views
What this Session (writted down) means?: udp from 127.0.0.1:1033 to 127.0.0.1:162 I think it is IP Spoofing using SNMP but I don´t understand why Fortinet uses that. Fortinet is taking out information from my Private Network?

    5 replies

    Anonymous_UserAuthor
    Contributor III
    March 17, 2004
    This is what my Firewall is reporting using Alert mail... attack_id=109 src=127.0.0.1 dst=201.129.206.7 src_port=80 dst_port=1339 interface=external status=dropped proto=6 service=1339/tcp msg=" IP spoofing [Reference: http://www.fortinet.com/ids/ID109]"
    smardak
    smardak
    New Member
    April 3, 2004
    Have you checked IDS for all Interfaces? If you have only checked the external interface, then you miss the attacks that origin from your internal lan (infected PC?). Perhaps one of your own PCs sends messages with 127.0.0.1 as source ip? Stefan
    Anonymous_UserAuthor
    Contributor III
    April 8, 2004
    hi, i have the same message from logging, somone outside the lan is scanning all ports. I asked my isp for having confirmation, he say thats effectively someone with 127.0.0.1 is trying to connect in my wan. What can i do in order to have is true adress, in order to stop him. Thanks a lot.
    Anonymous_UserAuthor
    Contributor III
    April 8, 2004
    You might be able to sniff the packet and track it down via MAC address. IMO it wouldn' t be worth the time. The FG is dropping the spoofed packets, so no worries.
    pace
    pace
    New Member
    April 19, 2004
    hallo everybody, i have seen this 127.0.0.1 based ids warnings on a customer fgt (MR6) they where caused by a old " forgotten" workstation which was previous infected by a Blaster virus the workstation AV program has not removed the whole virus, so the virus starts to scan random ip ranges to distribute itself :) fgt ids detects this distribution attempt i used the fgt sniffer (GREAT tool) to find out the MAC address of the workstation ! we located the system and cleaned it successfully... effect -> no more 127.0.0.1 ids warnings ! greetings
    Terms & ConditionsAccessibility statement