is it possible that such an IP address exists? i guess not so where does it originate?


You're probably seeing this as a result of the SYN flood that you posted about in another question.

The answer lies in how SYN floods actually work. The main principle behind them is that the packets arriving at the target must come from a source address that is unreachable, for maximum effectiveness.

Why? Because the SYN packets need to open a session (the first part of the TCP handshake) on the target machine, which remains open as long as possible, taking up resources on the target.

If the source IP was reachable, the target machine would send a reply, and immediately get a connection reset back. The TCP session would close instantly, or at least very quickly. The resources would be freed up. Not much of an attack.

On, and I should specify that it doesn't matter what the "real" source address is, of the attacker. The address you see above is just inserted into the packet headers. It's meaningless, but it does the job.

So SYN flood source IP's must necessarily be unreachable.


No, such an address does not exist as routable on the internet, 0.* is reserved for local network hosts according to RFC1700.