Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We just installed a SonicWALL NSA 3500 and I've noticed a few times per day there will be an alert entry like this:

Time: 01/02/2013 9:00:41.000

Priority: Alert

Category: Intrusion Prevention

Message: IP spoof dropped

Source:, 123, X0 (My note: nslookup tells me it belongs to some Sprint/PCS network, but the X0 interface is our LAN-facing interface. I also see here sometimes with the same MAC address, and we don't have a network. It's always that same MAC address!)

Destination: 192.168.x.x, 123, X0 (My note: This has shown as a few of our internal servers' IP's)

Notes: MAC address: 00:b0:d0:74:13:74 (My note: Appears to be a Dell MAC address, but doesn't match any of our known Dell computers on file)

When I perform an "arp -a | findstr 74-13-74" on my Windows PC I don't show that MAC address in my ARP table.

Is there a way I can track down what this is? We do use SonicWALL's SSL-VPN to tunnel into the X0 interface, maybe somebody uses a Sprint aircard and something is messing up? Maybe we have some malicious device somewhere? I'm very open to suggestions, this is puzzling me.

share|improve this question
Try blocking that MAC address and see if anyone complains. Either way, problem solved. – Sammitch Jan 2 '13 at 21:18
Can't really accept a comment as an answer, but I did that and it worked. So, thanks. – armani Jan 3 '13 at 14:04
Blocked the MAC address and looked to see who complains. – armani Jan 3 '13 at 14:05
Actually that didn't work -- got more messages this morning. This time the source IP was, still on the X0 [LAN] interface. – armani Jan 3 '13 at 18:55
Did the MAC address change, or did it not get blocked correctly? – Sammitch Jan 3 '13 at 20:50

If I were you, I'd port mirror, tap, or hub that network attached to the firewall and use accurate packet capture, such as "tcpdump -vvenXs0".

share|improve this answer
I do have a Throwing Star Lan Tap (downside: brings the link down to 100Mb), and the SonicWALL appears to have port mirror capability. I usually save packet captures as a last resort, was hoping someone familiar with SonicWALLs knew something better. – armani Jan 2 '13 at 17:50
Even if I did do that, what would I gain? What would I be looking for? I already know the MAC, but that's it. – armani Jan 3 '13 at 18:55
up vote 0 down vote accepted

I blocked the offending MAC address, and in the past year never got a complaint from a user, so that seems to be the fix.

share|improve this answer
As so far I understand, what if that was an attack and if the attacker changes his machine and attacks with a new MAC? You have to block again! – pavanw3b Mar 7 '15 at 7:41

So the thing here is to go spelunking around the switches to isolate the location of the source. You could figure out a window period where this is happening and focus your efforts there. If it's in a regular interval, then that's a great thing. Anything else, is a pain.

share|improve this answer

protected by Community Mar 14 '13 at 17:25

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.