incoming intrusion ip's same source mac

The source mac is not the mac address of the origin source. It's the address of the system where the L2 packets come from. Normaly it's the mac address of the LAN interface of your UTM or Internet modem.

hi,

Its interesting as going through all the logs on the utm, only the intrusion (telnet/ssh) ones have that source mac , normal traffic (logged for awhile) does not have that macaddress. and its not the address of the router or my utm. confusing :)

Hi,

according to the MAC address it must be a Cisco device. Do you have any Cisco devices in your WAN/LAN? Is the address similar to another device? E.g. the ports of a switch have always unique mac addresses. They only differ in the last positions.

Maybe the providers modem has another virtual interface with a management IP address which your UTM don't know. So IPS will block traffic from this interface. But why should a management interface forward public traffic!?

Jas

BTW: Is initf="eth2" your WAN interface?

Hi,

oddly no its not a cisco (visibly) , yes ethf2 is wan address. Big mistery :) as no other traffic has that source address.

Yep, mystical.....I've heard the title music of the X-Files in my brain after reading it :)
(and I've just realized how old I am....."X-Files".....)

Then, in my opinion, it must be another device in the providers LAN which forwards traffic to your connection. Is the destination IP your WAN IP?

Guys, the srcmac on traffic arriving from the Internet is that of your ISP's last-hop router if your modem is in bridge mode.  If it's in routing mode, then it's the MAC of the NIC connected to your UTM.

Cheers - Bob

Sure, that's what I also wrote/meant in my first post.

But why comes the blocked traffic from another mac address than the allowed traffic?

Sure, that's what I also wrote/meant in my first post.

But why comes the blocked traffic from another mac address than the allowed traffic?