RE: possible causes of source and destination ip from external network

["Tom Arseneault" <TArseneault () counterpane com>]

One possibility is a host on your network has been compromised and it
being used by an attacker to send out spoofed packets. You'd need to
check the MAC addresses on the packets and see if you can track down
where their coming from then quarantine that machine. 

Thomas J. Arseneault 
Security Engineer
Counterpane Internet Security
tarseneault () counterpane com

> -----Original Message-----
> From: Annie Green [mailto:annie_r_green () hotmail com] 
> Sent: Saturday, June 19, 2004 7:09 AM
> To: focus-ids () securityfocus com
> Subject: possible causes of source and destination ip from 
> external network
>
> Hi all
>
> What would be the possible causes of the IDS alert that shows 
> source ip and destination ip from external network? Also, why 
> did the router route this packet in the first place?
>
> Regards,
> A.
>
> _________________________________________________________________
> Get MSN Hotmail alerts on your mobile. 
> http://en-asiasms.mobile.msn.com/ac.aspx?cid=1002
>
>
> --------------------------------------------------------------
> -------------
>
> --------------------------------------------------------------
> -------------

---------------------------------------------------------------------------

---------------------------------------------------------------------------