GFi WebMonitor log contains external IP addresses (Full Version)

All Forums >> [ISA Server 2004 Firewall] >> Logging and Reporting



Message


ReschMark -> GFi WebMonitor log contains external IP addresses (25.May2010 3:15:08 PM)

Hi All

We run GFi WebMonitor on ISA 2004. Recently I noticed that the 'Top Policy Breakers' report (from WebMonitor) contains two entries indicating the requests to an anonymouse proxy site were blocked. That part makes sense - we don't allow users to access to anonymous proxies.

The source IP address on these requests, however, is NOT one of our internal IP addresses. It is an IP from Beijing, China that is a well known source or port scans and other hacking attempts.

Has anyone else seen this sort of thing? Can anyone offer an explaination as to how a Chinese IP address is (at least to WebMonitor) appearing to originate from my private network?

Thanks much
-Mark




elmajdal -> RE: GFi WebMonitor log contains external IP addresses (28.May2010 8:20:11 AM)

Maybe an Internal User is using a chinese proxy server :)




Page: [1]