Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a site that is getting bombarded by requests from 10.10.0.3 and 10.10.0.4. I couldn't find where these servers are. What is the best way to regulate this? I could just deny those IP's but I have a feeling it would just start using other IP's.

Any suggestions would be helpful.

share|improve this question

migrated from stackoverflow.com Oct 15 '10 at 14:33

This question came from our site for professional and enthusiast programmers.

1  
Maybe some of your local machines got a trojan? –  Arman Oct 15 '10 at 14:45
    
Where are you seeing these addresses? TCP connections to your server (if so, what port or service)? "Received:" headers in messages? Somewhere else? –  Gerald Combs Oct 15 '10 at 16:29
add comment

4 Answers

up vote 6 down vote accepted

The IP addresses 10.0.0.0 to 10.255.255.255 are reserved for private networks, i.e. the traffic you see is coming somewhere from your internal network, so try to figure out which machines those are, or contact your hosting provider and have them poke around what their 10.10.0.3 machine is doing.

share|improve this answer
    
If Jason is behind a NAT'ing firewall, it could be NAT'ing an external address that's sending spam. Alternatively, it could also just be something else that's hosted by the same provider. –  Richard Gadsden Oct 15 '10 at 17:20
    
While it's most likely true that those IPs he is seeing are on his LAN, my company is currently about to cut loose an ISP that is exposing THEIR 10.0.0.0/8 IPs to -our- LAN which is also on 10.0.0.0/8. Highly annoying. –  Cypher Oct 16 '10 at 4:42
add comment

You can't figure out where those servers are on the Internet because that's an internal Intranet IP address. Whoever is spamming you is apparently on the same network as you. You might want to look into that.

share|improve this answer
add comment

In response to the other answers here: It could also be forged IP headers. Ask your ISP to do a proper job (ie, block spoofed IP's).

share|improve this answer
add comment

Those are rfc1918 private address blocks, and cannot be used on the internet, and generally are not routable, though I suppose that it may well be that you can forge them as a from address and not have them dropped.

These are either from your local network (if it is using a private adress space because internet access is NATed), or you can just drop them (include all the rfc1918 address spaces).

share|improve this answer
    
+1 for RFC citation. Give a man a fish... –  AndyN Oct 15 '10 at 16:44
1  
"We've traced the call. It's coming from inside the house." –  Gerald Combs Oct 15 '10 at 18:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.