Re: Odd packet?

[Maarten <fulldisc () ultratux org>]

On Tuesday 25 May 2004 22:35, Steffen Schumacher wrote:
> On 25.05.2004 21:55:19 +0000, Maarten wrote:
> > On Tuesday 25 May 2004 15:57, Gregh wrote:
> > > Getting quite a few 127.0.0.1 on differing ports lately and I know it
> > > isn't originating FROM this machine. Haven't sniffed any packets but
> > > they come up in logs.
> >
> > Not saying what you see must be wrong but, if your routing / packetfilter
> > / kernelsettings were properly configured you would not ever get these
> > packets as they would be dropped before they would reach your machine. 
> > If not your ISP, then you (indeed everyone) should always drop packets
> > coming from interfaces they _cannot_ originate from.  Antispoofing,
> > that's called. Especially 127.x.x.x is not routed by any ISP which is
> > worth their name.
>
> Logs may still detect packets constructed with a 127/8 address.
> However, as you said, no ISP, which has to follow rules and regulations in
> the western world allows spoofing of or even routing of the 127/8 net.
>
> So Maarten, if you want to write again, please have packetdumps proving you
> case.

Hum...  Aren't you confusing me with Gregh, the OP ?  
And if not, what do you want me to prove ? That 127.0.0.1 is not routed...?

Maarten

> /Steffen

-- 
Yes of course I'm sure it's the red cable. I guarante[^%!/+)F#0c|'NO CARRIER

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html