Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We just installed a SonicWALL NSA 3500 and I've noticed a few times per day there will be an alert entry like this:

Time: 01/02/2013 9:00:41.000

Priority: Alert

Category: Intrusion Prevention

Message: IP spoof dropped

Source: 173.115.237.234, 123, X0 (My note: nslookup tells me it belongs to some Sprint/PCS network, but the X0 interface is our LAN-facing interface. I also see 10.0.0.4 here sometimes with the same MAC address, and we don't have a 10.0.0.0 network. It's always that same MAC address!)

Destination: 192.168.x.x, 123, X0 (My note: This has shown as a few of our internal servers' IP's)

Notes: MAC address: 00:b0:d0:74:13:74 (My note: Appears to be a Dell MAC address, but doesn't match any of our known Dell computers on file)

When I perform an "arp -a | findstr 74-13-74" on my Windows PC I don't show that MAC address in my ARP table.

Is there a way I can track down what this is? We do use SonicWALL's SSL-VPN to tunnel into the X0 interface, maybe somebody uses a Sprint aircard and something is messing up? Maybe we have some malicious device somewhere? I'm very open to suggestions, this is puzzling me.

share|improve this question
    
Try blocking that MAC address and see if anyone complains. Either way, problem solved. –  Sammitch Jan 2 '13 at 21:18
    
Can't really accept a comment as an answer, but I did that and it worked. So, thanks. –  armani Jan 3 '13 at 14:04
    
Blocked the MAC address and looked to see who complains. –  armani Jan 3 '13 at 14:05
    
Actually that didn't work -- got more messages this morning. This time the source IP was 107.42.210.236, still on the X0 [LAN] interface. –  armani Jan 3 '13 at 18:55
    
Did the MAC address change, or did it not get blocked correctly? –  Sammitch Jan 3 '13 at 20:50

1 Answer 1

If I were you, I'd port mirror, tap, or hub that network attached to the firewall and use accurate packet capture, such as "tcpdump -vvenXs0".

share|improve this answer
    
I do have a Throwing Star Lan Tap (downside: brings the link down to 100Mb), and the SonicWALL appears to have port mirror capability. I usually save packet captures as a last resort, was hoping someone familiar with SonicWALLs knew something better. –  armani Jan 2 '13 at 17:50
    
Even if I did do that, what would I gain? What would I be looking for? I already know the MAC, but that's it. –  armani Jan 3 '13 at 18:55

protected by Community Mar 14 '13 at 17:25

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.