RE: private IP scans

["Sheahan, Paul (PCLN-NW)" <Paul.Sheahan () priceline com>]

I see this maybe once or twice a day.....you shouldn't see this often.
BM_3_4See section 3.4 at this link below for the most common causes (the
section is called "I'm seeing packets from "private" addresses (10.x.x.x et
al.) on the Internet side of my firewall").
http://www.robertgraham.com/pubs/firewall-seen.html
<http://www.robertgraham.com/pubs/firewall-seen.html> 
 
I would block private addresses from entering your firewall.
 
Paul Sheahan 
Manager of Information Security 
Priceline.com 
paul.sheahan () priceline com 
-----Original Message-----
From: White, Stacy [mailto:SWhite () catfish bbc peachnet edu]
Sent: Monday, April 08, 2002 3:31 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] private IP scans


Hey! I am new here so forgive me if I ask anything dumb right off the bat.
 
I am getting a lot of scans against my network from private IP ranges. Looks
random, and the IP's are random as well.
I am assuming a stealth scan, maybe NMAP. Anyone else experiencing this, or
know what it is?
 
Stacy White
swhite () bainbridge edu <mailto:swhite () bainbridge edu> 
(please note the change in my email address)
 
Network Administrator
BAINBRIDGE COLLEGE
 
229-248-2576
229-243-6421 FAX
 
_______________________________
 
"The pursuit of truth and beauty is a sphere of activity in which we are
permitted to remain children all our lives." --  Albert Einstein