RE: Land Attack when sending mail to a specific domain name
- From: "Wayne Small" <wayne@xxxxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Wed, 8 Aug 2001 09:56:30 +1000
Anthony,
I've not found a resolution, but I've accepted that I'll live with it
for the present. We're moving ourselves and this particular customer to
ADSL shortly, so I'll change the private IP's then and avoid this type
of issue on the future. Thanks for the response.
Regards,
Wayne Small MCSE+I
Correct Solutions Pty Ltd
Check out www.sbsfaq.com for more SBS FAQs and information.
Contributions welcome!
-----Original Message-----
From: Anthony Michaud [mailto:anthonym@xxxxxxxxxxxxxx]
Sent: Wednesday, 8 August 2001 9:28 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Land Attack when sending mail to a specific
domain name
http://www.ISAserver.org
See 2nd and 3rd paragraphs - thats what I was trying to look at :)
Have you found a resolution, or still looking?
--
Anthony Michaud
Network Administrator
eLogix Corporation Pty Ltd
Blessed are those who have no expectations, for they will never be
disappointed. --Buddha
> -----Original Message-----
> From: Wayne Small [mailto:wayne@xxxxxxxxxxxxxx]
> Sent: Wednesday, 8 August 2001 06:42
> To: [ISAserver.org Discussion List]
> Subject: [isalist] RE: Land Attack when sending mail to a specific
> domain name
>
>
> http://www.ISAserver.org
>
>
> Anthony,
>
> I believe that I have the answer to this now. Both our server and the
> clients have the same private IP behind our router, and I guess that
> this is being kept within the packet structure at some level
> and this is
> why our server think's it is being attacked. At least that's
> the answer
> I came up with.
>
> Regards,
> Wayne Small MCSE+I
> Correct Solutions Pty Ltd
>
> Check out www.sbsfaq.com for more SBS FAQs and information.
> Contributions welcome!
>
>
>
> -----Original Message-----
> From: Anthony Michaud [mailto:anthonym@xxxxxxxxxxxxxx]
> Sent: Tuesday, 31 July 2001 6:10 PM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] RE: Land Attack when sending mail to a specific
> domain name
>
>
> http://www.ISAserver.org
>
>
> "Land Attack sends SYN packets with the same source and destination IP
> addresses and the same source and destination ports to a host
> computer.
> " (taken from Q165005).
>
> You're going to have to give a little more info (IP of the other
> computer(s) involved, IP('s) of any others that you have that are
> relevant.
>
> Is it possible that their SBS is operating on the same IP? Does the
> mail get sent through even though you get the land notification?
>
> --
> Anthony Michaud
> Network Administrator
> eLogix Corporation Pty Ltd
>
> Blessed are those who have no expectations, for they will never be
> disappointed. --Buddha
>
>
> > -----Original Message-----
> > From: Wayne Small [mailto:wayne@xxxxxxxxxxxxxx]
> > Sent: Tuesday, 31 July 2001 17:48
> > To: [ISAserver.org Discussion List]
> > Subject: [isalist] RE: Land Attack when sending mail to a specific
> > domain name
> >
> >
> > http://www.ISAserver.org
> >
> >
> > No takers on this one? Don't tell me I've stumped you all?
> >
> > Wayne
> >
> > -----Original Message-----
> > From: Wayne Small
> > Sent: Friday, 27 July 2001 5:09 PM
> > To: [ISAserver.org Discussion List]
> > Subject: [isalist] Land Attack when sending mail to a
> specific domain
> > name
> >
> >
> > http://www.ISAserver.org
> >
> >
> > Hi All,
> >
> > I have a strange scenario in which I am getting the message
> below only
> > when I send email to one of my customers domains. I have
> an SBS 2000
> > box and the customer has NT4+MSX 5.5. I don't get this
> message when I
> > send to other similar customers, only this one. Any ideas on why?
> >
> > Subject: ISA Server alert: An intrusion was attempted by an external
> > user.
> >
> > ISA Server name: SERVER1
> > ISA Server detected a land attack on Internet Protocol (IP) address
> > 192.168.100.1.
> >
> > The 192.168.100.1 address is on my 2nd NIC which connects to my ISDN
> > router - the router maps it to a public address.
> >
> > Thanks in advance
> > Wayne Small
> >
> > ------------------------------------------------------
> > You are currently subscribed to this ISAserver.org
> Discussion List as:
> > wayne@xxxxxxxxxxxxxx To unsubscribe send a blank email to
> > $subst('Email.Unsub')
> >
> > ------------------------------------------------------
> > You are currently subscribed to this ISAserver.org Discussion
> > List as: anthonym@xxxxxxxxxxxxxx
> > To unsubscribe send a blank email to
> > $subst('Email.Unsub')
> >
>
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion List as:
> wayne@xxxxxxxxxxxxxx
> To unsubscribe send a blank email to
> $subst('Email.Unsub')
>
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion
> List as: anthonym@xxxxxxxxxxxxxx
> To unsubscribe send a blank email to
> $subst('Email.Unsub')
>
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
wayne@xxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
