Anthony, I believe that I have the answer to this now. Both our server and the clients have the same private IP behind our router, and I guess that this is being kept within the packet structure at some level and this is why our server think's it is being attacked. At least that's the answer I came up with. Regards, Wayne Small MCSE+I Correct Solutions Pty Ltd Check out www.sbsfaq.com for more SBS FAQs and information. Contributions welcome! -----Original Message----- From: Anthony Michaud [mailto:anthonym@xxxxxxxxxxxxxx] Sent: Tuesday, 31 July 2001 6:10 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: Land Attack when sending mail to a specific domain name http://www.ISAserver.org "Land Attack sends SYN packets with the same source and destination IP addresses and the same source and destination ports to a host computer. " (taken from Q165005). You're going to have to give a little more info (IP of the other computer(s) involved, IP('s) of any others that you have that are relevant. Is it possible that their SBS is operating on the same IP? Does the mail get sent through even though you get the land notification? -- Anthony Michaud Network Administrator eLogix Corporation Pty Ltd Blessed are those who have no expectations, for they will never be disappointed. --Buddha > -----Original Message----- > From: Wayne Small [mailto:wayne@xxxxxxxxxxxxxx] > Sent: Tuesday, 31 July 2001 17:48 > To: [ISAserver.org Discussion List] > Subject: [isalist] RE: Land Attack when sending mail to a specific > domain name > > > http://www.ISAserver.org > > > No takers on this one? Don't tell me I've stumped you all? > > Wayne > > -----Original Message----- > From: Wayne Small > Sent: Friday, 27 July 2001 5:09 PM > To: [ISAserver.org Discussion List] > Subject: [isalist] Land Attack when sending mail to a specific domain > name > > > http://www.ISAserver.org > > > Hi All, > > I have a strange scenario in which I am getting the message below only > when I send email to one of my customers domains. I have an SBS 2000 > box and the customer has NT4+MSX 5.5. I don't get this message when I > send to other similar customers, only this one. Any ideas on why? > > Subject: ISA Server alert: An intrusion was attempted by an external > user. > > ISA Server name: SERVER1 > ISA Server detected a land attack on Internet Protocol (IP) address > 192.168.100.1. > > The 192.168.100.1 address is on my 2nd NIC which connects to my ISDN > router - the router maps it to a public address. > > Thanks in advance > Wayne Small > > ------------------------------------------------------ > You are currently subscribed to this ISAserver.org Discussion List as: > wayne@xxxxxxxxxxxxxx To unsubscribe send a blank email to > $subst('Email.Unsub') > > ------------------------------------------------------ > You are currently subscribed to this ISAserver.org Discussion > List as: anthonym@xxxxxxxxxxxxxx > To unsubscribe send a blank email to > $subst('Email.Unsub') > ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: wayne@xxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')