Re: [suse-security] how to detect spoofing hosts

30 Oct 2001

      Reserved class A's you should NEVER see traffic from (at least until they
start getting desperate for IP's):

0.0.0.0/255.0.0.0
1.0.0.0/255.0.0.0
2.0.0.0/255.0.0.0
5.0.0.0/255.0.0.0
7.0.0.0/255.0.0.0
10.0.0.0/255.0.0.0
23.0.0.0/255.0.0.0
27.0.0.0/255.0.0.0
31.0.0.0/255.0.0.0
36.0.0.0/254.0.0.0
39.0.0.0/255.0.0.0
41.0.0.0/255.0.0.0
42.0.0.0/255.0.0.0
58.0.0.0/254.0.0.0
60.0.0.0/255.0.0.0
68.0.0.0/252.0.0.0
72.0.0.0/248.0.0.0
82.0.0.0/254.0.0.0
84.0.0.0/252.0.0.0
88.0.0.0/248.0.0.0
96.0.0.0/224.0.0.0
197.0.0.0/255.0.0.0
219.0.0.0/255.0.0.0
220.0.0.0/252.0.0.0

multicast (almost no-one uses this).

224.0.0.0/224.0.0.0

Kurt Seifried, kurt@seifried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://www.seifried.org/security/