RE: Ip spoof from 0.0.0.0

[Russell Fulton <r.fulton () auckland ac nz>]

On Thu, 2002-11-07 at 13:29, Omar Herrera wrote:
>  
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> It seems that something similar has been discussed before:
> http://archives.neohapsis.com/archives/iss/2000-q1/0461.html

but this is not a SYN flood, or even a SYN trickle.  It is one or two
packets per hour targeted at individual addresses in the low half of a
/24.

Yes, I saw one of these yesterday in a /24 that I monitor.  Have not
seen anything in our main address block yet.

-- 
Russell Fulton, Computer and Network Security Officer
The University of Auckland,  New Zealand

"It aint necessarily so"  - Gershwin


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com