We just installed a SonicWALL NSA 3500 and I've noticed a few times per day there will be an alert entry like this:
Time: 01/02/2013 9:00:41.000
Category: Intrusion Prevention
Message: IP spoof dropped
Source: 18.104.22.168, 123, X0 (My note: nslookup tells me it belongs to some Sprint/PCS network, but the X0 interface is our LAN-facing interface. I also see 10.0.0.4 here sometimes with the same MAC address, and we don't have a 10.0.0.0 network. It's always that same MAC address!)
Destination: 192.168.x.x, 123, X0 (My note: This has shown as a few of our internal servers' IP's)
Notes: MAC address: 00:b0:d0:74:13:74 (My note: Appears to be a Dell MAC address, but doesn't match any of our known Dell computers on file)
When I perform an "arp -a | findstr 74-13-74" on my Windows PC I don't show that MAC address in my ARP table.
Is there a way I can track down what this is? We do use SonicWALL's SSL-VPN to tunnel into the X0 interface, maybe somebody uses a Sprint aircard and something is messing up? Maybe we have some malicious device somewhere? I'm very open to suggestions, this is puzzling me.