RE: Intruder is external nic
- From: "Larry Lentz" <Larry@xxxxxxxxxxxxxxxxx>
- To: "ISA Server Discussion List" <isalist@xxxxxxxxxxxxx>
- Date: Wed, 27 Nov 2002 12:26:20 -0600
Amy,
What I do when I have an intrusion like that is immediately create an IP
packet filter to totally block the offending IP address. I've found this
to be effective.
If you want to see where the attack is coming from, try looking up the
IP address at www.samspade.org/t/ <http://www.samspade.org/t/>
There is a script available on the ISA Toolzz web site that supposed
automatically creates a blocking packet filter but I haven't been able
to get it to work.
Larry
----------------------------------------------
Larry Lentz, MCSE+I, MCDBA
MCSE on Windows 2000
GoldMine Certified Professional
Lentz Computer Services
GoldMine Solutions Partner
San Antonio, Texas
Larry@xxxxxxxxxxxxxxxxx
For networking that makes sense,
Count on Lentz!
----------------------------------------------
-----Original Message-----
From: Amy Babinchak [mailto:Amy@xxxxxxxxxxxxxxxxxxxxxxxxxx]
Sent: Tuesday, November 26, 2002 6:09 PM
To: ISA Server Discussion List
Subject: [isalist] Intruder is external nic
http://www.ISAserver.org
I'm getting intrusion detection alerts for port scan and the IP
address listed is the ISA external NIC. I'm not sure where to begin
troubleshooting this. Suggestions?
Amy Babinchak
Technology Consultant
------------------------------------------------------
List Archives:
http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter:
http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ:
http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion
List as: larry@xxxxxxxxxxxxxxxxx
To unsubscribe send a blank email to
$subst('Email.Unsub')
Other related posts:
