Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations biv343 on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Intrusion Detection and Logging

Status
Not open for further replies.
Stuartp

Stuartp

Technical User
Feb 22, 2001
178
GB
There was an alert in Event Viewer that ISA Server had detected an All Port Scan Attack etc. I looked in the logs, and around the same time, the packet filter log has different entries. Normally the "filter-rule" column says BLOCKED but then it changed to FRAGMENT during the time of this port scan.

I've searched and searched but cannot find what this means. According to Microsoft the column should either be 1 or 0. So what does FRAGMENT mean? I've checked and the settings are to only log blocked packets, but I'd welcome an explanation from anyone in the know about this kind of thing.

What should I look out for if someone had gained access?

Thanks for any help

Stuart
 
Status
Not open for further replies.

Similar threads

Sameer258
  • Locked
  • Question
Need Help to Find ip and mac address with email who one open my email
Replies
0
Views
809
Sameer258
Sameer258
Tommy_T
  • Locked
  • Question
Sonic wall - Have an issue remotely connectioning VNC and SMB (and AFP) to one of the 2 ISP circuits
Replies
1
Views
597
nnaarrnn
nnaarrnn
Nitta84
  • Locked
  • Question
navigation slow and tcp syc/ack drop
Replies
0
Views
504
Nitta84
Nitta84
ITSUPPORTIT
  • Locked
  • Question
VPN from ASA 5510 and RV215W problem
Replies
0
Views
166
ITSUPPORTIT
ITSUPPORTIT
texwiz
  • Locked
  • Question
need some help to properly set up, segregate and secure a network with an ASA 5505
Replies
2
Views
199
texwiz
texwiz

Part and Inventory Search

Sponsor

Back
Top