IP SCAN

  • From: "Alex Decarli" <decarli@xxxxxxxxxxxxx>
  • To: <isalist@xxxxxxxxxxxxx>
  • Date: Thu, 23 May 2002 09:14:23 -0300

Hi folks,
I've received the following message: "ISA Server detected an all port scan 
attack from Internet Protocol (IP) address xxx.xxx.xxx.xxx"

i've registered in IP...log several connections of this ip on port 80 (http)
 
is this a port scan attack ?
 

When I do a manual port scan , isa server says "ISA Server detected a 
well-known port scan attack from Internet Protocol (IP) address 
xxx.xxx.xxx.xxx. A well-known port is any port in the range of 1-2048. For more 
information about this event, see ISA Server Help.

Any idea ?

Alex Decarli

 

Other related posts: