Stopping generic http scanning

[ohif]

I am using e-trust Intrusion Detection and I have everything pretty well locked down tight. But in the alerts in Intrusion detection, there is always alerts about http intrusion scans...

Http generic intrusion scan
Http jrun common intrusions
Checkpoint firewall-1 remote resource overload
Http double slash access control circumvention
Mail-Relay
Http server-side intrusions
Http Cold-Fusion intrusions/scans

It then lists the ip of the attacker and most of the http intrusion alerts are from websites I have recently visited. The rules in IDS will not allow me to block this. Is there anything else I could do to stop this stuff??? Besides blocking ip's at the router?

 

[SgtB]

Responses from websites you visit should not be returning packets to your machine that contain these attack signatures, unless they are compromised sites that contain malicious code.
Are you sure the source IP is from the websites you visit? Or is the source IP your address?
Maybe posting the decoded packet of one such attack might help.

I'll see your DMCA and raise you a First Amendment.

http://www.anti-dmca.org

 

[karsh44]

Other than blocking some ip's though, you really can't stop port scanning. If you have everything locked down and stay on top of things, you don't have anything to worry about.

"I do not feel obliged to believe that the same God who has endowed us with sense, reason, and intellect has intended us to forgo their use."
- Galileo Galilei