RE: All Port Scan Attack Detection
- From: "Tom Mendelboim" <tomerm1@xxxxxxx>
- To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
- Date: Tue, 4 Mar 2003 22:34:33 -0700
You can't do a whole lot about it... This happens on almost every IP on
the Internet. The IP address scanning you probably belongs to some home
user that his/her computer is being used to relay the attack. You can
always block traffic from that IP but chances are you will see that
event log entry again from another IP. If it happens only once or twice,
I would not be too paranoid. If this keeps happening over and over
again, block it.
Tom
-----Original Message-----
From: jagadish.pai@xxxxxxxxxxxxxxxxxxx
[mailto:jagadish.pai@xxxxxxxxxxxxxxxxxxx]
Sent: Tuesday, March 04, 2003 9:41 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] All Port Scan Attack Detection
http://www.ISAserver.org
Hi
What should be done if the following notification by isa server.
ISA Server detected an all port scan attack from Internet Protocol (IP)
address 61.241.82.53.
For more information about this event, see ISA Server Help.
Regards
Pai
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tomerm1@xxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
