Risk: Medium
Original Extract:
A "LAND" attack involves IP packets where the source and destination address are set to address the same device. Older variants, as reported http://isc.sans.org/diary.php?date=2005-03-07 rely on the source address to be spoofed to the same value as the destination IP. A recent post to Bugtraq came up with a new twist: LAND attacks against routers and perimeter devices, addressed to the outside interface and with the source spoofed to the inside interface.
Rumour has it that these attacks are easily conducted and surprisingly "successful". The defense, though, is just as simple: Packets with spoofed source addresses have no business entering your perimeter networks.
If you have not yet applied ingress filtering on the outermost devices of your internet connection that you have control over, now is a good time to do so. RFC 2827 and RFC 3704 are good sources of information on ingress filtering and Reverse Path Forwarding. And don't forget to apply outbound spoofing filters as well - visit http://www.sans.org/rr/whitepapers/firewalls/1059.php for more information.