Page 1 of 1

Myster IP's in Firewall/connections

Posted: Sat Oct 02, 2010 7:25 am
by someuser
Hi,
I'm running a fairly standard hotspot on my rb750g. In my firewall connections directory,
I have a few IP's (usually only one IP at a time with many, many connections)that don't ping and aren't in my DHCP address list.
These are generally the ones with over 100 established connections. It's in the local DHCP range.
Any explanations?
I've had problems with P2P users and can usually scare them away or slow them down to 64k.
But, I'm not sure about the mystery ip's.
Are these spoofed? or?
How to troubleshoot?

Re: Myster IP's in Firewall/connections

Posted: Sat Oct 02, 2010 8:09 am
by fewi
They are very likely spoofed.
Sniff traffic, and look at MAC addresses

Re: Myster IP's in Firewall/connections

Posted: Sat Oct 02, 2010 9:15 am
by someuser
Aha,
Thanks.