is it possible that such an IP address exists? i guess not so where does it originate?
closed as too broad by Tom O'Connor Aug 25 '13 at 21:21
There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.
You're probably seeing this as a result of the SYN flood that you posted about in another question.
The answer lies in how SYN floods actually work. The main principle behind them is that the packets arriving at the target must come from a source address that is unreachable, for maximum effectiveness.
Why? Because the SYN packets need to open a session (the first part of the TCP handshake) on the target machine, which remains open as long as possible, taking up resources on the target.
If the source IP was reachable, the target machine would send a reply, and immediately get a connection reset back. The TCP session would close instantly, or at least very quickly. The resources would be freed up. Not much of an attack.
On, and I should specify that it doesn't matter what the "real" source address is, of the attacker. The address you see above is just inserted into the packet headers. It's meaningless, but it does the job.
So SYN flood source IP's must necessarily be unreachable.