Update: Scans From 192.168.0.134

It turns out that we were not blocking the RFC 1918 addresses at one place
were we should have had them filtered. This is going to be corrected - and
that will allow us to further narrow this down.

Thanks to all for the quick, thoughtful and thorough responses!

Best Wishes,
-DpB

"Douglas P. Brown" wrote:

> We are somewhat preplexed - Our IDS reported 8000+ SYN FIN scans from a
> non-routable address (192.168.0.134) to thousands of ours hosts
> yesterday. Our IDS setup is only seeing traffic that traverses our main
> router. Has anyone seen this before? Am I missing something? Any
> advice or direction you can offer would be greatly appreciated.
>
> Cheers,
> -DpB
> --
>
Received on Feb 01 2001