nurturer69
asked on
Port Scan attacked is logged
A single user logged on to day and has received an SEP message "A client will block traffic from IP address 192.168.x.x for the next 600 seconds (from 11/5/2014 11:30:15PM to 11/5/2014 11:40:15 PM) Port Scan attack is logged."
He tells me that he has received the same message twice more this morning, but nothing further
The IP address is from our own intranet server.
Are there some best known troubleshooting steps to resolve this issue (if it is an issue). Thanks.
He tells me that he has received the same message twice more this morning, but nothing further
The IP address is from our own intranet server.
Are there some best known troubleshooting steps to resolve this issue (if it is an issue). Thanks.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
If this issue is all internal, you can try the following (from Symantec Support):
In SEP, click on Change Settings (left side), then click on Network Threat Protection. In the Firewall tab, uncheck "Number of seconds to block" and uncheck "Enable port scan detection". Then click on OK. I suggest closing out and restarting and then test.
My laptop was registering port scans by my desktop and printer and this stopped it.
In SEP, click on Change Settings (left side), then click on Network Threat Protection. In the Firewall tab, uncheck "Number of seconds to block" and uncheck "Enable port scan detection". Then click on OK. I suggest closing out and restarting and then test.
My laptop was registering port scans by my desktop and printer and this stopped it.
ASKER
Turns out the this workstation is trying to access Spiceworks which resides on our intranet server and his workstation is interpreting the intranet servers communication as an attack. Where can I open up the ports to allow their access to his PC?