Re: possible causes of source and destination ip from external network

[Jose Nazario <jose () monkey org>]

On Sat, 19 Jun 2004, Annie Green wrote:

> What would be the possible causes of the IDS alert that shows source ip
> and destination ip from external network? Also, why did the router route
> this packet in the first place?

- misconfiguration of the router or the sensor
- you are providing transit you didn't know you were over hard, routed
  links
- you have rogue network access points (ie APs) you didn't expect
- spoofed addresses in the traffic

an incomplete list, but you get the idea.

________
jose nazario, ph.d.                     jose () monkey org
http://monkey.org/~jose/                http://infosecdaily.net/

---------------------------------------------------------------------------

---------------------------------------------------------------------------