[Intrusions] ISA Server port scan attack - servers own external ip address

[Mueller, Eric]

ISA Server name: ISA-STANDALONE

 

ISA Server detected an all port scan attack from Internet Protocol (IP)
address 192.168.1.252.

 

For more information about this event, see ISA Server Help.

 

And

 

ISA Server name: ISA-STANDALONE

 

ISA Server detected a well-known port scan attack from Internet Protocol
(IP) address 192.168.1.252. A well-known port is any port in the range
of 1-2048. For more information about this event, see ISA Server Help.

 

 

This ip address in these message alerts is binded to the external NIC of
the ISA Server. Has anyone experienced this or has heard of this?

 

Thanks

Eric 



*******************************************
Confidentiality Notice: This e-mail message, including any attachments, from AtlantiCare contains information which is CONFIDENTIAL AND/OR LEGALLY PRIVILEGED. The information is intended only for the use of the individual named above and may not be disseminated to any other party without AtlantiCare's written permission. If you are not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, disclosure, distribution, copying or taking of any action in reliance on the contents of this e-mailed information is strictly prohibited. 
If you have received this e-mail in error, please notify us immediately by telephone at 609 - 569 - 7070 or notify us by e-mail at Isecurity at Atlanticare.org to arrange for the return of these documents to us without cost to you.