understand why packet dropped ?

Alberto

I capture this:

--File Index : 1.--

--9 packets captured.--

-----Statistics------------
Number Of Bytes Failed To Report:        0
Number Of Packets Forwarded     :        0
Number Of Packets Generated     :        0
Number Of Packets Consumed      :        0
Number Of Packets DROPPED       :        9
Number Of Packets Status Unknown:        0

*Packet number: 1*
Header Values:
 Bytes captured: 48, Actual Bytes on the wire: 48
Packet Info(Time:03/03/2021 15:12:11.000):
 in:X1*(interface), out:--, DROPPED, Drop Code: 493(IP Spoof check failed recorded in module network), Module Id: 25(network), (Ref.Id: _1514_jqTqppgDifdl), 1:1)
Ethernet Header
 Ether Type: IP(0x800), Src=[f4:4c:7f:a6:5a:6d], Dst=[c2:ea:e4:f0:91:21]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.5.100.73], Dst=[10.10.243.1]
UDP Packet Header
 Src=[8499], Dst=[8499], Checksum=0xf211, Message Length=14 bytes
Application Header
 Not Known: 
Value:[1]
Hex and ASCII dump of the packet:
 c2eae4f0 9121f44c 7fa65a6d 08004500 002226ae 40003a11 *.....!.L..Zm..E.."&.@.:.*
 aec30a05 64490a0a f3012133 2133000e f2110600 00005a00 *....dI....!3!3........Z.*


*Packet number: 2*
Header Values:
 Bytes captured: 48, Actual Bytes on the wire: 48
Packet Info(Time:03/03/2021 15:12:16.128):
 in:X1*(interface), out:--, DROPPED, Drop Code: 493(IP Spoof check failed recorded in module network), Module Id: 25(network), (Ref.Id: _1514_jqTqppgDifdl), 1:1)
Ethernet Header
 Ether Type: IP(0x800), Src=[f4:4c:7f:a6:5a:6d], Dst=[c2:ea:e4:f0:91:21]
IP Packet Header
 IP Type: UDP(0x11), Src=[10.5.100.73], Dst=[10.10.243.1]
UDP Packet Header
 Src=[8499], Dst=[8499], Checksum=0xf211, Message Length=14 bytes
Application Header
 Not Known: 
Value:[1]
Hex and ASCII dump of the packet:
 c2eae4f0 9121f44c 7fa65a6d 08004500 0022285a 40003a11 *.....!.L..Zm..E.."(Z@.:.*
 ad170a05 64490a0a f3012133 2133000e f2110600 00005a00 *....dI....!3!3........Z.*

I don't understand why IP Spoof ?

Alberto

shiprasahu93

@Alberto
Please check your routing table if there is anything incorrectly configured there.
Also can you check what is the ARP entry showing up for 10.10.243.1.
Thanks!