[Dshield] Increased port activity question

jwalzer forum at dshield.org
Thu Aug 11 13:08:54 GMT 2005



I am using the Mars appliance from Cisco (formely Protego) for log consolidation and one thing I've noticed as of late is that an alert is generated with the Cisco 565 cache engine as the source using port 0 going to a destination IP/port of 0.0.0.0/80. I am trying to determine is this is a false positive and standard behavior of the cache engine. Has anyone ever comes across this before?

Thanks 
This message was sent via the web forum at
http://forum.dshield.org



More information about the list mailing list