Re: Scans From 192.168.0.134

  NMAP allows one to send bogus source IP addresses along w/
  real prbes to obfuscate the source. Could it be that these
  scans are mated with other IP addresses?

  -alan

Thus spake Douglas P. Brown (Doug_at_UNC.EDU)
 on or about Thu, Feb 01, 2001 at 10:29:57AM -0500:
> We are somewhat preplexed - Our IDS reported 8000+ SYN FIN scans from a
> non-routable address (192.168.0.134) to thousands of ours hosts
> yesterday. Our IDS setup is only seeing traffic that traverses our main
> router. Has anyone seen this before? Am I missing something? Any
> advice or direction you can offer would be greatly appreciated.
>
> Cheers,
> -DpB
> --
>
> Douglas P. Brown
> University of North Carolina
> I.T. Security Consultant
> 105 Abernethy Hall
Received on Feb 01 2001