?
Solved

Port Scan attacked is logged

Posted on 2014-11-06
3
Medium Priority
?
2,282 Views
Last Modified: 2014-11-07
A single user logged on to day and has received an SEP message "A client will block traffic from IP address 192.168.x.x for the next 600 seconds (from 11/5/2014 11:30:15PM to 11/5/2014 11:40:15 PM) Port Scan attack is logged."

He tells me that he has received the same message twice more this morning, but nothing further

The IP address is from our own intranet server.

Are there some best known troubleshooting steps to resolve this issue (if it is an issue). Thanks.
0
Comment
Question by:nurturer69
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 

Author Comment

by:nurturer69
ID: 40426713
More info:

Turns out the this workstation is trying to access Spiceworks which resides on our intranet server and his workstation is interpreting the intranet servers communication as an attack. Where can I open up the ports to allow their access to his PC?
0
 
LVL 64

Accepted Solution

by:
btan earned 1500 total points
ID: 40427794
Normally, you can check the Security Logs under Client Management for the alert to confirm the issue. In your case, you will need to add the intranet server's IP address in "Excluded Hosts."

To add the printer to "Excluded Hosts":
1.  Open your Intrusion Prevention Policy.
2.  Choose to Settings on the left.
3.  Check the box for Enable excluded hosts and then click the Excluded Hosts... button.  
4.  Add the IP address of your printer and choose Okay.

Do check the PC has latest engine and signature version as well. If there are further other intrusion alerts, you can create exception to allow a specific ID or signature as in
http://www.symantec.com/business/support/index?page=content&id=TECH97176
http://www.symantec.com/business/support/index?page=content&id=HOWTO55167
0
 
LVL 97

Expert Comment

by:Experienced Member
ID: 40428168
If this issue is all internal, you can try the following (from Symantec Support):

In SEP, click on Change Settings (left side), then click on Network Threat Protection. In the Firewall tab, uncheck "Number of seconds to block" and uncheck "Enable port scan detection". Then click on OK. I suggest closing out and restarting and then test.

My laptop was registering port scans by my desktop and printer and this stopped it.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
If you are looking at this article, you have most likely been hit by some version of ransomware and are trying to find out if there is anything you can do, or what way you should react - READ ON!
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question