Re: ISA Server detected an IP half-scan

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: "Phillip Windell" <philwindell@xxxxxxxxxxx>
Date: Wed, 10 Oct 2007 10:23:27 -0500

If you see the alert, ISA did its job. There is nothing to do.

If there ever is a successful attack, there won't be an alert because it
won't be seen as an attack.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

"Vishal" <Vishal@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:0486F0B5-F3CE-4409-A6BF-E58AD89CC111@xxxxxxxxxxxxxxxx

Hi,

I am getting the following errors on my ISA Server 2004 dashboard:

"ISA Server detected an IP half-scan attack from IP address
81.108.173.229"

what should I do?

Thx

Prev by Date: Re: Problem with HTTP non-default port connections
Next by Date: Re: Web Proxy filter failed to bind its socket
Previous by thread: Re: ISA Scripting
Next by thread: Re: Script to Block source attacker
Index(es):
- Date
- Thread

Relevant Pages

RE: SBS Sp1 - ISA2004 - IP Half scan attacks
... alert warning that ISA Server detected an Internet Protocol half-scan ... an attack is attempted against your network. ... If you have enabled the intrusion detection on ISA, ...
(microsoft.public.windows.server.sbs)
RE: ISA Server or Firewall Appliance?
... There is a clear distinction between "under attack" and "compromised". ... Security Platform Group (ISA SE) ... ISA Server or Firewall Appliance? ... " The only last point I'd make is that I'd be hesitant in deploying ISA ...
(Focus-Microsoft)
Re: Block Attacker showing wierd name - not just IP...
... There is no way the script can properly evaluate the traffic because it doesn't exist by the time the script runs. ... I wonder if the attack comes fast enough so that ISA is ... >2 - if the alert fired, ...
(microsoft.public.isa)
RE: ISA, VPNs and false positives
... You can configure ISA 2004 log as follows: ... ISA Server features an intrusion-detection ... mechanism that identifies when an attack is attempted against your network. ... If you have enabled the intrusion detection on ISA, ...
(microsoft.public.windows.server.sbs)
Re: Publishing ftp server
... if the attack "fits" one of the attack profiles ISA is built to look ... Understanding the ISA 2004 Access Rule Processing ... Microsoft Internet Security & Acceleration Server: Partners ... Microsoft ISA Server Partners: Partner Hardware Solutions ...
(microsoft.public.isa.publishing)