Endpoint Protection

 View Only

  • 1.  Port Scan attacks from internal IP's

    Posted Feb 23, 2015 02:53 PM

    Ever since I installed Symantec Security Suite for Enterprise,  our pc will get a message that traffic will be blocked from an internal IP for 600 seconds.   I will check the content and scan the machine of the IP address in question, but find nothing.

     

    Any ideas?



  • 2.  RE: Port Scan attacks from internal IP's

    Posted Feb 23, 2015 02:56 PM

    Because it's likely harmless. Various Windows services create a bunch of extra noise which cause it to be detected by SEP because it hit a specific threshhold. What ports are being scanned?



  • 3.  RE: Port Scan attacks from internal IP's

    Posted Feb 23, 2015 03:07 PM

    I will check it the next time it comes around.