Perhaps its a spoofed ip address. -----Original Message----- From: ertan.gokalp@xxxxxxxxxx [mailto:ertan.gokalp@xxxxxxxxxx] Sent: Thursday, August 08, 2002 8:51 AM To: [ISAserver.org Discussion List] Subject: [isalist] all port scan attack http://www.ISAserver.org Hi, My ISA server sends me the following message """ISA Server name: aaaaaa ISA Server detected a well-known port scan attack from Internet Protocol (IP) address xxx.xxx.xxx.xxx. A well-known port is any port in the range of 1-2048. For more information about this event, see ISA Server Help.""" xxx.xxx.xxx.xxx ih the external IP of the ISA server.?????? I don't understand why it attacks itself , what is the meanning of this message.Please help me. Ertan ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: amurrey@xxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')