• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

port scanning detected in event logs

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 Firewall] >> General >> port scanning detected in event logs Page: [1]
Login
Message << Older Topic   Newer Topic >>
port scanning detected in event logs - 18.Aug.2004 4:29:00 PM   
prem

 

Posts: 11
Joined: 10.Aug.2004
From: India
Status: offline
Dear All,

I have been detecting a lot of entries in the eventviewer that says that ISA server has detected a port Scan from some external IP address. These ip addresses keep on changing

Does ISA reset the connection when it detects a portscan happening on its interface, or does it allow the port scan to continue.

Can we configure ISA to reset connections doing a port scan.I enabled all the tabs under the intrusion detection,but was curious whether the connection is actually being dropped or no.
Post #: 1
RE: port scanning detected in event logs - 18.Aug.2004 11:51:00 PM   
baldy

 

Posts: 37
Joined: 1.Mar.2002
From: The Netherlands
Status: offline
Prem,

I have no solution, but do have the same problem.

In my case these portscans originate from my ISP's mailservers(according to the eventlogs).

I am using Popcon to retrieve my mail from my ISP and found that all portscans logged are related to traffic to port 110.

It seems that ISA falsely logs these portscans.

Regards,

Klaas

(in reply to prem)
Post #: 2
RE: port scanning detected in event logs - 19.Aug.2004 11:52:00 AM   
prem

 

Posts: 11
Joined: 10.Aug.2004
From: India
Status: offline
Hi Klass,

Same here with me, the port scans seem to come from the strangest locations including my ISP's routers !

Seems like a case for the X-Files ! [Big Grin]

(in reply to prem)
Post #: 3
RE: port scanning detected in event logs - 27.Jan.2006 12:03:35 AM   
Zapata

 

Posts: 28
Joined: 25.May2003
Status: offline
Same here, ISA reports port scans from some of my ISPīs routers, but mostly when a user browses a web page, ISA then tells me a port scan is done from the Webserver!!??

Maybe Tom have some clue to this, Tom?

(in reply to prem)
Post #: 4

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 Firewall] >> General >> port scanning detected in event logs Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts