IP Spoofing

[technical1]

Good Morning All,
Ive noticed the following in my sys logs, could anyone shed some light on what they REALLY are, and whether my PIX has been compromised?

Output:
PIX-2-106016: Deny IP spoof from (127.0.0.1) to ip.ad.dr.ess on interface outside
PIX-2-106016: Deny IP spoof from (127.0.0.1) to ip.ad.dr.ess on interface outside

Regards,
Vinay

 

[routerman]

This message indicates that the packet has an invalid source address, in this case the loopback address 127.0.0.1 which is a reserved address. The PIX has not been compromised, but is indicating that its dropping these invalid packets.

I suspect that these packets are most likley to originate from an internal mis-configured host, as 127.0.0.0 addresses are supposed to be dropped by ISP routers. Therefore you should not see this address appear on the outisde interface.