On reviewing the firewall log on my router (supplied by my fibre provider), I noticed a few curious entries. Several teardrop or derivative attacks, I'd expect to see things like this in the log from public addresses, but these appear to originate from within the network.
I understand what a teardrop attack is - using the fragment offset field to confuse a device during reassembly of tcp packets, thus causing denial of service in vulnerable devices. In this case the firewall appears to have blocked it.
I have a reasonable confidence that none of the devices within my network are compromised, I believe the device that was assigned this IP at the time was actually an android based phone. So, can a device accidentally generate a tcp packet that the firewall could interpret as a teardrop, or this more likely to be a spoofed Ip in the source address?