our antivirus guy will send me alerts from symantec. sometimes it gets these hits
[Somebody is scanning your computer. Your computer's TCP ports: 10000, 8910, 70, 32774 and 59906 have been scanned from xxx.xx.1.2.] xxx.xx.1.2 is the firewall. If i put the host ip that is affected in the forwarded traffic in fortiview I do not see the event listed at the time. is this just some wild traffic from the firewall or could it be something to worry about?
It might depend on the security profile of that PC. Also, the firewall has to have Layer 2 adjacency to the device in question. If there is another router in-between, it would not be able to scan those. If Symantec is configured exactly the same on more than one PC in that network, I would think it would affect more than one, yes.
The source address being the firewall though seems to indicate that it must be this though and not a random attacker from the Internet. It would have the attacker's IP address if it was, right?
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
