MessageEddie, We are in the same boat. ISA stops the attack, but does not give details. We are looking at some additional s/w that will give details. Such as Black Ice or ACID Intrusion Detection Tool. There are some annoying people out there, and then some bad ones. Shane ----- Original Message ----- From: Eddie Kwong To: [ISAserver.org Discussion List] Sent: Thursday, April 25, 2002 2:02 PM Subject: [isalist] Intrusion allert, any help/idea is much appreciated http://www.ISAserver.org Hi all, during the last one minute time frame, I have received more than 390 Intrusion allert message from ISA Server from the following 'ISA Server detected an all port scan attack from Internet Protocol (IP) address 63.210.101.141.' What do you people do with this? Any suggestion is appreciated. I used to receive less than five/ten of these message a day and I presume it is normal. Many thanks Eddie ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: tsmullins@xxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')