Update: Scans From 192.168.0.134

["Douglas P. Brown" <Doug () UNC EDU>]

It turns out that we were not blocking the RFC 1918 addresses at one place
were we should have had them filtered.  This is going to be corrected - and
that will allow us to further narrow this down.

Thanks to all for the quick, thoughtful and thorough responses!

Best Wishes,
-DpB

"Douglas P. Brown" wrote:

> We are somewhat preplexed - Our IDS reported 8000+ SYN FIN scans from a
> non-routable address (192.168.0.134) to thousands of ours hosts
> yesterday.  Our IDS setup is only seeing traffic that traverses our main
> router.  Has anyone seen this before?  Am I missing something?  Any
> advice or direction you can offer would be greatly appreciated.
>
> Cheers,
> -DpB
> --