RE: Re: Wayyy too many spoofed packets

[Daniel Linder <dan_linder () yahoo com>]

Can you setup the iptables rules on the other machines to log
broadcasts from your "suspect" server and see if they see it coming in
at the same time too?  I would guess that your first server has Samba
running and sending SMB broadcasts to the network, and the iptables is
seeing the traffic.  Does the iptables log keep the MAC address?  Might
help you track it down.

Dan

--- Bill Royds <broyds () rogers com> wrote:
> As Frank said, you machine is sending broadcasts on both interfaces
> for
> Samba. So you see the broadcasts as received as well. It is not
> coming from
> the net but from your machine itself.


__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards