Spoofed IP?

DIDS · Post by **DIDS** » Sun Jul 22, 2001 10:23 pm

I just got these 3 entries in my Linksys logging program:

Jul 23, 2001 00:07:15.740 UTC 192.168.1.231 : 137 >>> XX.XX.XXX.XXX : 137 NetBIOS Name, Chode, Msinit

Jul 23, 2001 00:07:17.110 UTC 192.168.1.231 : 137 >>> XX.XX.XXX.XXX : 137 NetBIOS Name, Chode, Msinit

Jul 23, 2001 00:07:18.700 UTC 192.168.1.231 : 137 >>> XX.XX.XXX.XXX : 137 NetBIOS Name, Chode, Msinit

The thing is I dont have a PC in my network with a IP like that. I figure this is probably someone trying a spoof to get into my Network. Anyone have any clue if I am right or not?

newbie69 · Post by **newbie69** » Sun Jul 22, 2001 10:30 pm

bleach · Post by **bleach** » Mon Jul 23, 2001 6:35 am

i doubt it, it looks like thats a request to get a netbios name table for your ip, and even if someone did spoof it they wouldn't be very smart because in order to get the info back to the person it needs their destination ip, which if spoofed won't ever reach them. it's probably some internal broadcast or something

Croc · Post by **Croc** » Mon Jul 23, 2001 9:14 am

The IP 192.168.1.231 you are referring to is internal.
It is not coming from outside. You're logging an outgoing request from a computer within your own network.
Hope this helps.

Croc

DIDS · Post by **DIDS** » Mon Jul 23, 2001 10:38 am

It's not a outbound request. It is a inbound request. I only have 2 internal IP address's ending in 100 and 101. The inbound requests never made it past my router.

Croc · Post by **Croc** » Tue Jul 24, 2001 2:27 am

DIDS,
Are you using Virtual Private Networking?
Just a thought.
Trying to find a possible for ya!

Croc.

DIDS · Post by **DIDS** » Tue Jul 24, 2001 8:03 am

Nope. I am not using a VPN. They haven't tried again. So it is no real biggie. Just the first time I have ever seen a Inbound connection attempt from a IP like that. Thanks for the replies.