2

Source : 252.205.75.128

Destination : 221.58.178.105

Both IP's do not belong to us. Direction was Inbound. How is this possible?

Then why are these IP addresses routed to my network ?

  • Where did you see it? On a boundary device or on an internal device? It is not unusual to see public IP's bouncing of your boundary devices. – TheJulyPlot Jan 10 '17 at 11:01
2

Scanning into your boundary devices from the public internet from unknown IP’s is normal behaviour. Everyone from government agencies, research and education institutes to the bad guys looking to do harm are continually scanning the internet for a variety of reasons.

If your boundary devices or alerting devices such as your IDS/IPS are fagging this up, it is up to you have you manage it. You can either allow them to continue to alert you or you can tune it out once you have deemed it to be benign.

In my experience it is typical for denied connections on boundary devices to be tuned out of alerting tools such as SIEM or IDS/IPS.

If it isn’t benign, then you will want/need to take the appropriate remediative action as per your incident response plan. So for example; If IP’s within your network are being scanned from the public internet, then your IPS is doing its job correctly by alerting you are potential threat, a threat that you should investigate and take action on if needed.

| improve this answer | |
  • Thank you for your response, But the source and destination of the incident did not belong to us. If source address spoofed, the destination should be us. Here I am observing different IP which does not belong to us. – user95437 Jan 12 '17 at 13:38
0

Could tcpreplay have been executed on a network interface for one of your IDS systems with a pcap file for testing purposes?

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.