Probably a change in policy. Exclude the event if you don't want it reported.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Hee Kiong Sent: Tuesday, October 04, 2005 4:10 AM To: [email protected] Subject: [ISSForum] Ping Sweep Hi, I have a server running whatsup application that monitors various servers at a remote site by using ICMP ping. The whatsup server will poll those servers every minute. I have an IDS installed at the remote site to monitor the incoming and outgoing traffics. The whatsup server has been running for about 1 1/2 years and only recently (2 months ago) I saw the ping sweep events showed at the remote IDS. The event showed me that the source IP is from the whatsup server and the destination IP addresses are those various servers at the remote site. The whatsup server is doing the ICMP sweep those servers and it is a valid event I would like to know why this happens only just recently whereas I should see this event on the first day I got the whatsup server in place. Is it possible that this is false positive reports? How can you show that it is a false positive events? Hope to get some help here. Thanks -- Hee Kiong Lau Danawan Technologies Sdn Bhd Tel: +673-2237777 Fax: +673-2237778 Mobile: +673-8712237 _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
