RE: Land Attack when sending mail to a specific domain name
- From: "Wayne Small" <wayne@xxxxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Wed, 8 Aug 2001 06:42:04 +1000
Anthony,
I believe that I have the answer to this now. Both our server and the
clients have the same private IP behind our router, and I guess that
this is being kept within the packet structure at some level and this is
why our server think's it is being attacked. At least that's the answer
I came up with.
Regards,
Wayne Small MCSE+I
Correct Solutions Pty Ltd
Check out www.sbsfaq.com for more SBS FAQs and information.
Contributions welcome!
-----Original Message-----
From: Anthony Michaud [mailto:anthonym@xxxxxxxxxxxxxx]
Sent: Tuesday, 31 July 2001 6:10 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Land Attack when sending mail to a specific
domain name
http://www.ISAserver.org
"Land Attack sends SYN packets with the same source and destination IP
addresses and the same source and destination ports to a host computer.
" (taken from Q165005).
You're going to have to give a little more info (IP of the other
computer(s) involved, IP('s) of any others that you have that are
relevant.
Is it possible that their SBS is operating on the same IP? Does the
mail get sent through even though you get the land notification?
--
Anthony Michaud
Network Administrator
eLogix Corporation Pty Ltd
Blessed are those who have no expectations, for they will never be
disappointed. --Buddha
> -----Original Message-----
> From: Wayne Small [mailto:wayne@xxxxxxxxxxxxxx]
> Sent: Tuesday, 31 July 2001 17:48
> To: [ISAserver.org Discussion List]
> Subject: [isalist] RE: Land Attack when sending mail to a specific
> domain name
>
>
> http://www.ISAserver.org
>
>
> No takers on this one? Don't tell me I've stumped you all?
>
> Wayne
>
> -----Original Message-----
> From: Wayne Small
> Sent: Friday, 27 July 2001 5:09 PM
> To: [ISAserver.org Discussion List]
> Subject: [isalist] Land Attack when sending mail to a specific domain
> name
>
>
> http://www.ISAserver.org
>
>
> Hi All,
>
> I have a strange scenario in which I am getting the message below only
> when I send email to one of my customers domains. I have an SBS 2000
> box and the customer has NT4+MSX 5.5. I don't get this message when I
> send to other similar customers, only this one. Any ideas on why?
>
> Subject: ISA Server alert: An intrusion was attempted by an external
> user.
>
> ISA Server name: SERVER1
> ISA Server detected a land attack on Internet Protocol (IP) address
> 192.168.100.1.
>
> The 192.168.100.1 address is on my 2nd NIC which connects to my ISDN
> router - the router maps it to a public address.
>
> Thanks in advance
> Wayne Small
>
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion List as:
> wayne@xxxxxxxxxxxxxx To unsubscribe send a blank email to
> $subst('Email.Unsub')
>
> ------------------------------------------------------
> You are currently subscribed to this ISAserver.org Discussion
> List as: anthonym@xxxxxxxxxxxxxx
> To unsubscribe send a blank email to
> $subst('Email.Unsub')
>
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
wayne@xxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
