Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
What is Spoof Attack?
#1
I checked the log on my router (Dlink DI-624), and noticed the following entries.

Mar/23/2006 03:05:58 Target IP(192.168.0.255), Target Port(137) Packet Dropped
Mar/23/2006 03:05:58 Spoof IP(192.168.0.106), Spoof Port(137)
Mar/23/2006 03:05:58 Spoof Attack fromd MAC(00-80-45-2b-ab-2a) Detect,

The log lists the last event on the top.

This entry was repeated numerous times over 2 hour period (from 2AM to 4AM). Does anyone know what this means? It does not sound good, and has any harm done to my network? Do I need to do anything to safe my network? I am little scared.

Thank you.
Reply
#2
Port 137 is for Windows Networking.
The script kiddies are just scanning IPs, looking for vulnerable Windows PCs.
A Spoof Attack is http://en.wikipedia.org/wiki/Spoof_attack
Reply
#3
Port 137 is a NETBIOS port, a common attack point for script kiddies, worms, etc.


See, I get up to get a beer, yell at the kids, scratch my nutsack, then come back to hit post, and now it's just redundant.
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)