detect ip spoofing attack

[Chuck Swiger]

On Aug 17, 2007, at 3:31 PM, Miguel wrote:
> Hi, i tink im suffering an ip (or mac, im not sure) spoofing  
> attack, my internet link is at 90% and mostly outgoing traffic, im  
> using pf (for nat), so i run pftop and i see a lot of connections   
> from one specific ip address (192.168.206.68), but this address is  
> not assigned to any pc, and it doesnt respond ping either, nmap  
> doesnt report any open port .  I see the translations and  
> stablished traffic in pftop and the traffic flow using tcpdump, how  
> can i know what computer is causing this traffic, looking for the  
> mac address in every pc should be the last alternative  :-(

Do you have a wireless basestation anywhere?  Someone could be  
borrowing your bandwidth, otherwise, you've probably got a laptop or  
some hacked machine lying around, which appears to have an Intel NIC  
in it.  :-)

You could try firewalling off all traffic from IP 192.168.206.68 and  
see whether anyone complains.  You could also try looking at switch  
statistics to locate which port the traffic is coming from, or run  
tcpdump on the IP and pull cables until you localize the machine.

-- 
-Chuck