Clemens Renner wrote:
> Regarding the advice from several people that the complaining admin
> should provide more details on the alleged "port scan": I will ask him
> to do that the next time he contacts me.
BTW: I've seen this before on a misconfigured TAP/SPAN when the IDS can
only see half of the connection (the recieves but not the sends for
example). Since the IDS sees a ton of SYNs without the corresponding
SYN/ACKs it looks like a portscan.
Your web server probably has more connections per second than any other
device on your network...
-Corey Smith
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"