Re: Intrusion allert, any help/idea is much appreciated

  • From: "Shane Mullins" <tsmullins@xxxxxxxxxxxxxx>
  • To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
  • Date: Thu, 25 Apr 2002 14:17:57 -0400

MessageEddie,

    We are in the same boat.  ISA stops the attack, but does not give details.  
We are looking at some additional s/w that will give details.  Such as Black 
Ice or ACID Intrusion Detection Tool.  There are some annoying people out 
there, and then some bad ones.


Shane 
  ----- Original Message ----- 
  From: Eddie Kwong 
  To: [ISAserver.org Discussion List] 
  Sent: Thursday, April 25, 2002 2:02 PM
  Subject: [isalist] Intrusion allert, any help/idea is much appreciated


  http://www.ISAserver.org


  Hi all, during the last one minute time frame, I have received more than 390 
Intrusion allert message from ISA Server from 

    the following

    'ISA Server detected an all port scan attack from Internet Protocol (IP) 
address 63.210.101.141.'

    What do you people do with this?

    Any suggestion is appreciated.

    I used to receive less than five/ten of these message a day and I presume 
it is normal.

    Many thanks

    Eddie


  ------------------------------------------------------
  You are currently subscribed to this ISAserver.org Discussion List as: 
tsmullins@xxxxxxxxxxxxxx
  To unsubscribe send a blank email to $subst('Email.Unsub') 

Other related posts: