SNORT - Strange Wan Alert !!
-
Hello,
I have some strange Wan alert. The source IP is not an public adress but an local adress like 192.168.100.13. And it scan 2 port 5511 and 22191.
See file.
Some body are some answers.
Regards
Jean-Noël
-
It's not scanning anything. It's almost certainly a response to some traffic you sent out that one of your ISP's routers (which is privately addressed, not extremely common, but not unheard of either with dwindling IPv4 space available) sent back in response. It's telling you destination port 5511 is unreachable. Generally that's because that traffic is being blocked. Not sure what 5511 would be, that's not a common port assigned to anything in particular, and why it would be blocked isn't clear.
-
Have you got any mobile phones attached to your network?
I only ask because I've seen this port used when people make a wireless connection and stream Video cam feeds using Geoview.
