Network Attack Coming from own IP

[part9282]

boy I sure you guys are able to help me figure this out. I've been having some attacks lately and the originating source is my own IP:

 	 #61-(6-73) 	 [nessus] [cve] [icat] [bugtraq] [arachNIDS] [local] [snort] WEB-CGI wrap access 	 2008-12-10 16:06:29 	 97.xxx.yyy.255:53629 	 67.135.105.139:80 	 TCP
	#62-(6-74) 	[snort] (http_inspect) DOUBLE DECODING ATTACK 	2008-12-10 16:06:29 	97.xxx.yyy.255:54827 	64.236.115.51:80 	TCP
	#63-(6-75) 	[snort] (http_inspect) OVERSIZE REQUEST-URI DIRECTORY 	2008-12-10 16:07:15 	97.xxx.yyy.255:50217 	74.125.103.39:80 	TCP

Where 97.xxx.yyy.255 is my ip. The odd part about it is the last three numbers. I connect with a cable modem and have never seen it before. The 255 is reserved, I thought, and has a unique purpose - like a local network? Can anyone help me on this?

[Coburn64]

The attacker/attackers are possibly using IP address spoofing to fool you. As long as you've got good defense, you'll be right.

[dxqcanada]

97.xxx.yyy.255 is the broadcast address for your network.

Someone is attempting to make your router/PC drop this broadcast onto you network.
Since the source IP address is your internal network ... they hope that your router/PC will be fooled into thinking it is a reply to a packet that originated from your private network, and therefore will let it in.

Since it is the broadcast address of the network, all IP devices on that network may accept it.

[coopstah13]

that isn't necessarily the broadcast address, it depends what the network mask is, I have an IP as such

inet addr:10.101.136.206  Bcast:10.101.137.255  Mask:255.255.254.0

nothing is stopping me from using 10.101.136.255

[dxqcanada]

Ah, I stand corrected.

I assumed a class C subnet mask.
In actual fact the default mask for a 97 network is a class A.

What the OP's network is using ... is unknown at this moment.

[part9282]

OP=other person?

I'll be getting back on this in a second. I've decided my network has been comprimised and am doing a clean install.

I think you are right that someone is trying gain trusted access. I'm installing a pretty hard /etc/sysctl.conf (added sourcerouting [already had rp_filteron though]) also I think iptables might be able to help. Will:

iptables -A INPUT -i eth0 -s <-97.xxx.yyy.255> -j DROP

help stop attacks, or would that cause another problem? The source ip may be part of the internal network, early attacks seemed to orginate from the isp.