|
|
|
|
|
|
|
|
 |
 |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] RE: [FW1] 169.254.X.X ip addresses in state table
I'm with Glenn on this one, and mostly because I'm in that group of employees that has to disable DHCP to do my job. When I'm configuring a batch of switches in-band, I'll pick an address scheme from anywhere, but being human, chances are pretty good that it's often in the same general range. If you have a network analyzer, it's sometimes useful to 'sniff' the segment you believe the host resides on, and check out his MAC. Most sys-admins can rule out some possibilities, simply by looking at the manufacturer portion (printer? HP? Sun? Cisco? 3Com?); we tend to buy devices in batches, and you can often recognize what batch this host probably came from , even if you don't know specifically who it is. Should it turn out to be a router, don't assume anything - it could be natural or it could be a poorly executed hack. Check your config for sub-interfaces, virtual terminals, and do a port span on everything if you've got the bandwidth (you can set up triggers to catch that range with NAI's sniffer, if it's intermittant, and just grab the headers if you're worried about overruning the buffer). Alternatively, you could just initiate a rule based on that address range, disallowing everything, and wait for your phone to ring... -----Original Message----- From: Tony Wong [mailto:[email protected]] Sent: 28 March 2001 1:05 PM To: [email protected] Subject: [FW1] 169.254.X.X ip addresses in state table I have been getting a lof of errors in my event log with some ip addresses that do not belong to my network: 169.254.X.X when i type in fw tab -t host_table > lichost.txt I can see that the src ip is 169.254.X.X and destination to somewhere on the internet. Any idea of what and where this ip address is coming from? Thanks ================================================================================ To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================================================
|
||||||||||
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
