Archived from groups: comp.dcom.lans.ethernet (More info?)

We had some intermittent SBC Yahoo DSL outages on our LAN the past
couple of weeks. I got it running and now am getting a lot of IP
Spoofing messages from the router. Why do I get these messages? And
why does the DSL connection drop intermittently?

Here's what I did to get to this point. Yesterday I tried to get it
running again but the SBC Self-support tool said it couldn't find the
router even with a direct connection between the router and the PC
running the tool. Had the same problem when the tool asked to reset to
previously known good settings.

I reconnected the PC to the network. Today I did ipconfig/all from the
command prompt and saw that the default gateway was 192.168.0.3 and
the DHCP server was 192.168.2.3. The DSL modem (a Speedstream
5100)address was 192.168.0.1. The DSL modem is connected to the WAN
port of an SMC Barricade 7004ABR router, which had an address of
192.168.2.3. I reset the SMC router address to 192.168.0.3, and
rebooted the PC. Internet connection came up and all was apparently
well. Didn't check the logs. The SMC router is set up to send alerts
to my email address. Checked email tonight and saw about 50 IP
Spoofing alert messages from the router.

Interestingly, now the "Internet" LED on the DSL modem lights up.
Previously, it did not.

Here is one of the alert messages:
Return-Path: <kloucks@jvlnet.com>
Delivered-To: spamcop-net-pc9guy@spamcop.net
Received: (qmail 9477 invoked from network); 29 Jun 2004 02:37:59
-0000
Received: from unknown (HELO c60.cesmail.net) (192.168.1.105)
by blade6.cesmail.net with SMTP; 29 Jun 2004 02:37:59 -0000
Received: from mailgate.cesmail.net (216.154.195.36)
by c60.cesmail.net with SMTP; 28 Jun 2004 22:37:58 -0400
Message-Id: <36a1ov$2e40rm@c60.cesmail.net>
X-Ironport-AV: i="3.81R,137,1083556800";
d="scan'208"; a="81920886:sNHT26288020"
Received: (qmail 31238 invoked from network); 29 Jun 2004 02:37:58
-0000
Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101)
by mailgate.cesmail.net with SMTP; 29 Jun 2004 02:37:58 -0000
Delivered-To: kloucks@jvlnet.com
Received: from emerald.jvlnet.com [156.46.57.20]
by mailgate.cesmail.net with POP3 (fetchmail-6.2.1)
for pc9guy@spamcop.net (single-drop); Mon, 28 Jun 2004 22:37:58 -0400
(EDT)
Received: (qmail 27444 invoked from network); 29 Jun 2004 02:30:55
-0000
Received: from ppp-67-38-163-228.dsl.mdsnwi.ameritech.net (HELO brnt)
(67.38.163.228)
by emerald.jvlnet.com with SMTP; 29 Jun 2004 02:30:55 -0000
From: <kloucks@jvlnet.com>
To: kloucks@jvlnet.com
Subject: Alert Message!!!
X-UIDL: `5"#!gBg"!2$$"!>%="!
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade6
X-Spam-Level: ****
X-Spam-Status: hits=4.8 tests=DATE_MISSING,FROM_AND_TO_SAME,
MSGID_FROM_MTA_HEADER,NO_REAL_NAME,PLING_PLING version=2.63
X-SpamCop-Checked: 192.168.1.105 216.154.195.36 192.168.1.101
156.46.57.20 67.38.163.228

Dear User
Your router has detected and protected you against an attempt to gain
access to your network. This may have been an attempted hacker
intrusion, or perhaps just your Internet Service Provider doing
routine network maintenance.
Most of these network probes are nothing to be worried about - these
types of random probes should NOT be reported, but you may want to
report repeated intrusions attempts. Save this email for comparison
with future alert messages.
Your router Alert Information

Time: 06/28/2004, 21:30:41
Message: IP Spoofing
Source: 192.168.0.1, 1833
Destination:239.255.255.250, 1900 (from WAN Inbound)


Visit the UXN Combat Spam web site to get more detailed information
about the intruder - http://combat.uxn.com/
1. Type the intruder's IP address into the IP WHOIS search engine
2. Click the Query Button
3. Detailed network and administration information will be displayed
(end of message)