Re: Intrusion Detected

  • From: Dar Scott <dsc@xxxxxxxx>
  • To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
  • Date: Thu, 8 Nov 2001 11:54:03 -0700


At 11:06 AM -0700 11/8/01, skip wrote:

My ISA server got a well-known port scan attack from Internet Protocol
(IP) address 12.x.x.x. this is the IP that is on  the external interface
on the ISA server, how can that be

I'm new to this, but I wonder....

If your ISA server is set up to masquerade, then would a scan from "inside" look like a scan from the external interface?

Dar



Other related posts: