Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am continouly getting errors log Deny IP due to Land Attack from IP to IP.

Both source and destination IP address are same.

Can any one please guide me what could be the issue and how I can fix this?

share|improve this question

migrated from stackoverflow.com Feb 3 '10 at 0:54

This question came from our site for professional and enthusiast programmers.

1  
StackOverflow is for programming related questions. You might want to ask this over on ServerFault or SuperUser... –  Terry Donaghe Feb 2 '10 at 23:19
    
What PIX OS are you using ? Answers are right but this may also be an false alert if your are running PIX one of the first v7 version –  radius Feb 3 '10 at 6:49

2 Answers 2

The Land Attack spoofs the source and destination IP to be the same basically causing the machine to continuously reply to itself causing a DOS. It's a pretty old attack and most OS's are now patched to not be vulnerable to this.

In this case I think your PIX is doing what it's supposed to and dropping the traffic. I don't think you have anything to worry about.

share|improve this answer

I'm not entirely sure there is something to "fix" in this case. There are a number of baseline security protections that are enabled in PIXOS, Land Attack protection being one of them.

One possibility you could do is check the MAC table in the PIX for the offending and attempt to track it down for remediation. However, I would not necessarily trust the results to be completely accurate.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.