Need urgent Help please

[saeen]

Hi,

I have pfsense running on my office network with three interfaces em0,em1 and re0. We use re0 to connect to DSL (PPPOE) and i have named it WAN2 (because we had one net connection and for a while we were running two connections so its called WAN2).

Normally when traffic comes in on the WAN interface i see it on WAN2 but i have noticed in the past that sometimes i see DHCP request trying to go out from re0 interface.

But today i saw something strange (please see attached screenshot). I have two questions here
First why does it show the interface to be re0 and not WAN2 ?

All these source and destinations are not my internal network so i assume someone is trying to spoof the IP but still it should come in through the WAN2 interface and not the physical re0 interface.

Hope it makes pf sense :)