Trackdown IP sending Broadcasts to PIX?

Can you successfully ping or traceroute 10.0.0.9 from the PIX? The results might help isolate where the source is located. Take a look at the PIX route table to see how it would go back to 10.0.0.9.

Each router hop, ping and traceroute to 10.0.0.9 or do a 'show ip route 10.0.0.9' to see where the source is located.

HTH

The OP says he does not have a 10.0.x.x so it doesn't seem likely that the PIX would have a route to it.

We have similar messages from our FWSM logging packets from systems using 169.254 addresses because they've failed to get a DHCP response (we don't use dynamic address assignment on the network in question - we expect to register everything).

Stick a network monitor somewhere useful. That may not be on or near the PIX interface itself because if the packet has come from behind your core router then it will have the MAC address of the router, not the originating station. If the core router is a Cisco then SPAN or VACLs may help.

Sam

I think that would only work if the PIX ARPed for or received an ARP from that address. If the packet came from behind the core router then, even if that router were doing proxy ARP, the packet would have come from the router MAC address.

SAm