Hi, I'm writing because from 2 days, I'm getting strange records in LNS. First of all, I use Phantom rules from many time. The strange thing is that I'm receiving these alerts from 2 days. The alerts are related to Phantom rules, not default rules, but as I said before, the problem starts some days ago and I'm using the Phantom rule set for many time. I noticed this strange issue when I installed the VMWare WorkStation. It program add new "virtual" networks interface. maybe it's the cause? But I noticed these alerts event if the vmware isn't executed and moreover these alerts appared 1.000 times!!! Details: +Anti-MAC Spoofing, Source: 00:E0:4C:8E:9D:A9, Destination: 00:02:A4:00:A0:E2, Internet >> PC, Source port: 3785, Destination port: 1052. 0000:00 00 00 00 E6 51 CE 01 ....æQÎ. 0008:00 00 00 00 00 00 00 00 ........ 0010:00 00 00 00 00 00 00 00 ........ 0018:00 00 00 00 06 00 00 00 ........ 00203 22 04 00 53 9F 30 00 Ó"..SŸ0. 0028:00 00 00 00 00 00 00 00 ........ Note: All alerts are the same. Now I've about 5.000 same alerts in about 6 hours. Other alert I never seen before: Protocol, PC >> Internet, Source Address: 00:50:56:C0:00:01, Destination Address: FF:FF:FF:FF:FF:FF, Source: Nul=0.0.0.0. Src port: bootpc=68, Dest port: bootps=67. 0000:01 01 06 00 CA 0D AF 71 ....Ê.¯q 0008:1C 00 80 00 00 00 00 00 .€..... 0010:00 00 00 00 00 00 00 00 ........ 0018:00 00 00 00 00 50 56 C0 .....PVÀ 0020:00 01 00 00 00 00 00 00 ........ 0028:00 00 00 00 00 00 00 00 ........ 0030:00 00 00 00 00 00 00 00 ........ 0038:00 00 00 00 00 00 00 00 ........ 0040:00 00 00 00 00 00 00 00 ........ 0048:00 00 00 00 00 00 00 00 ........ 0050:00 00 00 00 00 00 00 00 ........ 0058:00 00 00 00 00 00 00 00 ........ 0060:00 00 00 00 00 00 00 00 ........ 0068:00 00 00 00 00 00 00 00 ........ 0070:00 00 00 00 00 00 00 00 ........ 0078:00 00 00 00 00 00 00 00 ........ 0080:00 00 00 00 00 00 00 00 ........ 0088:00 00 00 00 00 00 00 00 ........ 0090:00 00 00 00 00 00 00 00 ........ 0098:00 00 00 00 00 00 00 00 ........ 00A0:00 00 00 00 00 00 00 00 ........ 00A8:00 00 00 00 00 00 00 00 ........ 00B0:00 00 00 00 00 00 00 00 ........ 00B8:00 00 00 00 00 00 00 00 ........ 00C0:00 00 00 00 00 00 00 00 ........ 00C8:00 00 00 00 00 00 00 00 ........ 00D0:00 00 00 00 00 00 00 00 ........ 00D8:00 00 00 00 00 00 00 00 ........ 00E0:00 00 00 00 00 00 00 00 ........ 00E8:00 00 00 00 63 82 53 63 ....c‚Sc 00F0:35 01 01 FB 01 01 3D 07 5..û..=. 00F8:01 00 50 56 C0 00 01 0C ..PVÀ... 0100:05 61 6E 64 72 65 3C 08 .andre<. 0108:4D 53 46 54 20 35 2E 30 MSFT 5.0 0110:37 0A 01 0F 03 06 2C 2E 7.....,. 0118:2F 1F 21 2B FF 00 00 00 /!+ÿ... 0120:00 00 00 00 00 00 00 00 ........ 0128:00 00 00 00 .... Please help! These alerts don't stop!!!
For the first packet I don't know exactly what is the problem, but you should check if the MAC address of the blocked packet are correct. If the MAC address of your PC is not 00:02:A4:00:A0:E2 it is perhaps normal to have alerts on these packets. For the second packet it seems your PC is using DHCP protocol to get its IP. Frederic