Penetration Testing: Re: spoofing 255.255.255.255 techniques

From: Blake Frantz <blake_at_mc.net>
Date: Thu, 5 Jul 2001 21:13:58 -0500 (CDT)

> Our PIX does not indicate source or destination ports
> perhaps because the "IP spoof" criteria was already
> triggered in its logic chain, denying the packet and
> making a syslog entry.

It's been my experience that the PIX will not provide port information if
the packet is blocked by an ACL. However, it *will* provide port
information if the packet is blocked because there is no "conduit"
allowing the traffic.

I'm not sure if the spoof detection mechanism supercedes this.

Hope this helps.

-Blake

--------------------------------------------------------------------------------------

This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service
For more information on SecurityFocus' SIA service which automatically alerts you to
the latest security vulnerabilities please see:

https://alerts.securityfocus.com/
Received on Jul 06 2001