RE: Intrusion Attempt but IP is external IP of ISA

It's called IP spoofing.
The attacker sends a packet with your IP as in the "source IP" part of the 
header.
ISA recognizes this a garbage, and as Steve pointed out, blocks it and alerts 
you.

 Jim Harrison
 MCP(NT4, W2K), A+, Network+, PCG
 http://www.microsoft.com/isaserver
 http://isaserver.org/Jim_Harrison
 http://isatools.org

 Read the help, books and articles!
----- Original Message ----- 
From: "Grefenp Berchmann C Sodusta" <grefenp@xxxxxxxxxxx>
To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
Sent: Saturday, January 10, 2004 23:34
Subject: [isalist] RE: Intrusion Attempt but IP is external IP of ISA


http://www.ISAserver.org

:)

Thank you for the reply, but why is it the address is coming from the 
external ISA interface? is this normal?

Again thank you for your reply.

best regards,
grefenp





"Steve Moffat" <steve@xxxxxxxxxxxxxxxxxxxxxxxxxx> 
01/10/2004 05:54 PM
Please respond to
"[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>


To
"[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
cc

Subject
[isalist] RE: Intrusion Attempt but IP is external IP of ISA






http://www.ISAserver.org
Yes I had an idea, I thought it would be nice to get out for a couple of 
hours...then it started raining again...:(
 
 
Seriously...that's ISA doing it's job by blocking these intrusion's and 
informing you.
 
HTH
 
Steve

From: Grefenp Berchmann C Sodusta [mailto:grefenp@xxxxxxxxxxx] 
Sent: Saturday, January 10, 2004 3:55 AM
To: Isa Weblist
Subject: [isalist] Intrusion Attempt but IP is external IP of ISA

http://www.ISAserver.org 
hi guys, 

        Im receiving intrusion alerts from different IP sources, but for 
the past 2 days alerts are coming from the external IP of my ISA server. 
Anyone have any idea? 

        Thanks for your help. 

best regards,
grefenp ------------------------------------------------------ List 
Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server 
Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: 
http://www.isaserver.org/pages/larticle.asp?type=FAQ 
------------------------------------------------------ Other Internet 
Software Marketing Sites: Leading Network Software Directory: 
http://www.serverfiles.com No.1 Exchange Server Resource Site: 
http://www.msexchange.org Windows Security Resource Site: 
http://www.windowsecurity.com/ Network Security Library: 
http://www.secinf.net/ Windows 2000/NT Fax Solutions: 
http://www.ntfaxfaq.com 
------------------------------------------------------ You are currently 
subscribed to this ISAserver.org Discussion List as: 
steve@xxxxxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send a blank email to 
$subst('Email.Unsub') 
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as: 
grefenp@xxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub') 
This E-Mail is confidential. It is not intended to be read, copied, 
disclosed or used by any person other than the recipient named above. 
Unauthorised use, disclosure, or copying is strictly prohibited and may be 
unlawful. Optimum IT Solutions disclaims any liability for any action 
taken in connection of this E-Mail. The comments or statements expressed 
in this E-Mail are not necessarily those of Optimum IT Solutions or its 
subsidiaries or affiliates.
administrator@xxxxxxxxxxxxxxxxxxxxxxxxxx 


------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as: 
jim@xxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')



Other related posts: