topic Re: Using Splunk to analyze firewalls, how can I detect attackers who are doing IP spoofing attacks? in Splunk Search

Using Splunk to analyze firewalls, how can I detect attackers who are doing IP spoofing attacks?

btb2018 — Thu, 07 Feb 2019 11:04:17 GMT

How can I detect attackers using IP spoofing in Splunk?

I want to be able to detect this in Checkpoint and Juniper firewalls.

I presume a standard search operation would work, but how is anti-spoofing reported?

Thanks

Re: Using Splunk to analyze firewalls, how can I detect attackers who are doing IP spoofing attacks?

btb2018 — Thu, 07 Feb 2019 11:23:56 GMT

The aim here is to use Splunk to analyse firewalls.
The requirement is to use Splunk to see if any IP spoofing attacks have occurred.
Using index=checkpoint-opsec I am able to, for example, analyse the logs but which value in Checkpoint\ Juniper represents a spoofing attack or drop due to anti-spoofing on the firewall?

Re: Using Splunk to analyze firewalls, how can I detect attackers who are doing IP spoofing attacks?

mydog8it — Thu, 07 Feb 2019 14:52:26 GMT

I do not have Checkpoint experience, but here is info from Checkpoint's website:
Logs shows that traffic is dropped with "message_info: Address spoofing" in the "Information" field.
These logs appear for inbound packets on the external interface of Security Gateway, although these packets were received from the network that belongs to the same external interface.

Search for the action in the messages that match above