Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Deny IP spoof from (127.0.0.1)

Greetings!

I have recently began to receive these errors on my ASA 5510. I've done a debug when it occurs but haven't noticed an unusual traffic coming from the internal or external network.

here's the error:

2|May 03 2010|12:04:08|106016|||||Deny IP spoof from (127.0.0.1) to OUR_EXT_IP on interface outside


based on the message. should I be looking on the inside or outside of my fw? This is really the first time i've seen these messages so i'm sorta green to them.

if you need more logs, let me know and i can provide here. thanks for the help!

Everyone's tags (3)
2 ACCEPTED SOLUTIONS

Accepted Solutions
Cisco Employee

Re: Deny IP spoof from (127.0.0.1)

This is what syslog# 106016 means for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4768961

And the traffic is coming from the outside interface/external to your network.

Community Member

Re: Deny IP spoof from (127.0.0.1)

Hi,

It could be a virus attack or it could be that someone is trying to compromise the network by sending traffic using a soofed ip address. The best way would be take sniffer so that you could see the MAC address of the faulty machine/source.

Also, if you want to disable this log message, you can do that as well, as follows:

no logging message 106016


HTH

Ashu

3 REPLIES
Cisco Employee

Re: Deny IP spoof from (127.0.0.1)

This is what syslog# 106016 means for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4768961

And the traffic is coming from the outside interface/external to your network.

Community Member

Re: Deny IP spoof from (127.0.0.1)

Hi,

It could be a virus attack or it could be that someone is trying to compromise the network by sending traffic using a soofed ip address. The best way would be take sniffer so that you could see the MAC address of the faulty machine/source.

Also, if you want to disable this log message, you can do that as well, as follows:

no logging message 106016


HTH

Ashu

Community Member

Re: Deny IP spoof from (127.0.0.1)

thank you both for the answers.

i figured for sure it was coming form the outside but like i said, the debug wasn't very helpful when i was looking at it.

i'll setup a mirror port on my stack for the outside and see if i can catch it. thanks again, you've given me a great staring point.

5327
Views
0
Helpful
3
Replies
CreatePlease to create content