Hi folks, I've received the following message: "ISA Server detected an all port scan attack from Internet Protocol (IP) address xxx.xxx.xxx.xxx" i've registered in IP...log several connections of this ip on port 80 (http) is this a port scan attack ? When I do a manual port scan , isa server says "ISA Server detected a well-known port scan attack from Internet Protocol (IP) address xxx.xxx.xxx.xxx. A well-known port is any port in the range of 1-2048. For more information about this event, see ISA Server Help. Any idea ? Alex Decarli