Re: Weird Packet

[Ryan Russell <ryan () SECURITYFOCUS COM>]

On Tue, 20 Feb 2001, Leon Rosenstein wrote:

> The firewall has blocked Internet access to your computer (NetBIOS Name)
> from 10.1.1.205 (NetBIOS Name).
>
> Time: 2/19/2001 21:51:48
>
> How is it possible to have that non-routable IP send a packet my system?

What kind of Internet connection are you using?  It's quite common to see
packets from "neighbors" on DSL and cable modems.  Can you tell what
address the packet came to?  Was it something .255?  Windows machines will
broadcast within what they believe to be their own subnet for other
NerBIOS machines, specifically the NBName servie you've mentioned.  It's
quite likely that you've got someone with a NAT setup, and they are
leaking packets with a 10.x.x.x. source onto your providers network.

                                        Ryan