Urgent Problem 1

[shannanl]

Over the last couple of weeks we have been getting packet storms that flood the switches. I downloaded ethereal to see what was happening. So far this morning it has happened twice.

The first time it showed UDP packets and the source was 192.168.0.82 (the administrators laptop), the destination 192.168.0.255.

The second time it showed ICMP packets and the source was 192.168.0.4 (one of the file servers), the destination was 192.168.0.255.

We use 192.168.0.XXX as our static i.p. scheme. What is doing this? Is something spoofing the i.p. addresses?

Thanks in advance,

Shannan

 

[somebigguy]

When the final octet is 255, that means those machines are broadcasting. I would guess you have a virus or spyware on those machines.

There might be something spoofing internally. Ethereal should give you the MAC address of the source machine which should help you determine if that traffic is originating from the specified machine.

 

[shannanl]

Thanks for the help. I will find that sucker!!

Shannan