127.0.0.1
 

Here's a snip from the log of my NAT router from last night:
Now I understand that 127.0.0.1 is the network loopback address so how does it end up in the log? At the time, there were no PCs switched on - just the router.

Puzzled...

Re: 127.0.0.1
 

It's also known as 'localhost', but interesting log ... :eek:

Re: 127.0.0.1
 

These are malicious probes where the source IP address has been "spoofed": deliberately set to a false value, something other than the true sender. Certain NAT routers can be compromised by such incoming packets, because they construct a reply to themselves, 127.0.0.1.

Re: 127.0.0.1
 

This prompts me to ask two questions:
1) Is the sender trying to achieve anything other than tie my router in knots (and if so, how can they expect a reply)?
2) Should NTL be passing me packets that have so obviously been spoofed?

Re: 127.0.0.1
 

They certainly will not get a reply to the probe. The intention of the probe might be Denial of Service (crash the router), or maybe a carefully crafted probe, causing the router to reply to its own web configuration interface, might disable the router's security settings so that a later probe could take control of it. If such a thing were possible, it would likely be specific to one model of router.It's debatable what ISPs should or should not be doing in this area. NTL have started blocking certain ports which are commonly used by malicious probes, it would be a small extra step to filter out probes from obviously bogus source addresses. But the onus is really on the end-user to protect themselves, and no-one should rely on an ISP to do it for them (as a child might rely on a nanny). NTL's port-blocking can be seen as more of an attempt to prevent their network being overrun by worms, as much as an attempt to help the home user.

Re: 127.0.0.1
 

On that note, can anyone tell me who or what 192.168.0.1. is?

Re: 127.0.0.1
 

Private address space

see here

http://www.shmoo.com/mail/firewalls/...msg00016.shtml

Re: 127.0.0.1
 

The most likely candidate is your router itself.

Re: 127.0.0.1
 

127.0.0.1 is the number Fast Cache asks you to set your DNS (or TCP?) to.
Not sure if that helps.

Re: 127.0.0.1
 

Trouble is that spoofed packets can be generated to apear as they are from other sources as well as a loopback address.

The only way you can truly block these packets is to filter them as they leave the BGR of the isp. After this piont it is hard to identify them correctly.

If every isp in the world did this most dos, ddos and all rddos attacks would stop and the net would be a far better place.

Just my 2p's worth !

Re: 127.0.0.1
 

any idea what that means? :confused: :D

Re: 127.0.0.1
 

*off topic* nice yinyang zen :)

Re: 127.0.0.1
 

Every computer on the internet has a unique IP address except those that are in the range 10.*.*.* or 192.168.*.*. There can be many computers (or appliances) with the address 192.160.0.1 because it its in one of these ranges that are reserved for local addressing. If you type 192.168.0.1 into your browser you will only address your local computer/appliance - all others will be on the other side of your router.

Re: 127.0.0.1
 

Should I tell my firewall to allow this traffic?

Re: 127.0.0.1
 

If you have a router (or a Windows ICS) and if its IP address is 192.168.0.1, then, yes, you can allow it to talk to you through your firewall.