[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [ISSForum] Destination/Source IP



I have seen the same behavior, with some audit signatures like remote shared
folder access too. The same with lsass remote BO exploit. It's not very nice
to see these events, especially if there are correct IP addresses in the
Windows Event Viewer generated.

Martin

On 7/7/06, russell_tompkins@xxxxxxxxxxxxxxxx <
russell_tompkins@xxxxxxxxxxxxxxxx> wrote:
>
>
> Hi, we have SiteProtector in place and I have noticed that we are getting
> alerts where the Destination AND Source IP address are identical.
> These are external IP addresses and the majority of these alerts seem to
> be
> HTTP related?
> I have checked our Firewall logs to look at the traffic, but nothing looks
> suspicious.
> We have a number of SiteProtector consoles in place globally, each having
> multiple sensors reporting to them and each console has experienced the
> same problem?
> Has anybody seen this before this before?
>
>
> *******************************************************************
>
> This email and any files transmitted with it are confidential
> and intended solely for the use of the individual or entity
> to whom they are addressed. If you have received this
> email in error please notify the sender by replying to this
> email and then delete it from your system.
>
> No reliance may be placed upon this email without written
> confirmation of its contents and any liability arising from
> such reliance without written confirmation is hereby
> excluded.
>
> Sumitomo Mitsui Banking Corporation
>
> *******************************************************************
>
> _______________________________________________
> ISSForum mailing list
> ISSForum@xxxxxxx
>
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
> https://atla-mm1.iss.net/mailman/listinfo/issforum
>
> To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx
>
> The ISSForum mailing list is hosted and managed by Internet Security
> Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
>
_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.