Re: Intrusion Detection

It's been blocked.
Take a look in the IPEXT..log for that time fram (adjust for GMT).
THe details in that entry may help you understandhe "why" of that event.

  Jim Harrison
  MCP(NT4, W2K), A+, Network+, PCG
  http://isaserver.org/Jim_Harrison/
  http://isatools.org
  Read the help / books / articles!


On Fri, 16 Jul 2004 15:23:55 -0400
 "Tom Rogers" <trogers@xxxxxxxxxxxxxxxxxx> wrote:
http://www.ISAserver.org

I recv'd an "ISA Server detected an all port scan attack from Internet Protocol 
(IP) address 216.65.202.58" alert today.

What does ISA server do when it picks up attacks? Does it block the attack and 
attacker? Does it do nothing?

Thanx,

-TRR


------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as: 
jim@xxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist


Other related posts: