Just re-read you message. Thought you meant port scans ON the external NIC but you meant port scans FROM the external NIC. I've had a couple of those also but haven't tried to resolve them. Will be interested in any comments others might have. -----Original Message----- From: Amy Babinchak [mailto:Amy@xxxxxxxxxxxxxxxxxxxxxxxxxx] Sent: Tuesday, November 26, 2002 6:09 PM To: ISA Server Discussion List Subject: [isalist] Intruder is external nic http://www.ISAserver.org I'm getting intrusion detection alerts for port scan and the IP address listed is the ISA external NIC. I'm not sure where to begin troubleshooting this. Suggestions? Amy Babinchak Technology Consultant ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Exchange Server Resource Site: http://www.msexchange.org/ Windows Security Resource Site: http://www.windowsecurity.com/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: larry@xxxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')