RE: Re: Wayyy too many spoofed packets

["Chris de Vidal" <chris () devidal tv>]

Daniel Linder said:
> Can you setup the iptables rules on the other machines to log
> broadcasts from your "suspect" server and see if they see it coming in
> at the same time too?  I would guess that your first server has Samba
> running and sending SMB broadcasts to the network, and the iptables is
> seeing the traffic.  Does the iptables log keep the MAC address?  Might
> help you track it down.

Good ideas.  Nope, it does not show the MAC.

I suspect I'll have to wait 'til after Thanksgiving to work on this.. I
hoped to backend two PCs with a crossover and see what I see.

Thanks!
/dev/idal
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards