Re: Port scan from Apache?

Clemens Renner wrote:
> Regarding the advice from several people that the complaining admin
> should provide more details on the alleged "port scan": I will ask him
> to do that the next time he contacts me.
BTW: I've seen this before on a misconfigured TAP/SPAN when the IDS can 
only see half of the connection (the recieves but not the sends for 
example).  Since the IDS sees a ton of SYNs without the corresponding 
SYN/ACKs it looks like a portscan.

Your web server probably has more connections per second than any other 
device on your network...

-Corey Smith
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"