If it's not an IP address you recognize then you might go to SamSpade.org find out whose IP address that is and send along a complaint (with exact time/date details) to the admin of that IP block. If it is some punk trying to port scan you then maybe the Admin will be able to find out who from his logs. Takes about 2 minutes to track down the IP address and send the message; up to you if you have the time. I do it every now and then; usually don't get any response from the ISP on the other end so they might be ignoring them. <shrug> -Ben- Ben M. Schorr, MVP-Outlook, CNA, MCPx3 Director of Information Services Damon Key Leong Kupchak Hastert http://www.hawaiilawyer.com <http://www.hawaiilawyer.com/> -----Original Message----- From: Eddie Kwong [mailto:eddiek@xxxxxxxxxxxx] Sent: Thursday, April 25, 2002 8:00 AM To: [ISAserver.org Discussion List] Subject: [isalist] RE: MSN Messenger http://www.ISAserver.org Hi all, during the last one minute time frame, I have received more than 390 Intrusion allert message from ISA Server from the following 'ISA Server detected an all port scan attack from Internet Protocol (IP) address 63.210.101.141.' What do you people do with this? Any suggestion is appreciated. I used to receive less than five/ten of these message a day and I presume it is normal. Many thanks Eddie ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: bms@xxxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub')