<![CDATA[Ntop - Flow Floods]]>Hi

I've noticed a few messages in pfsenses system.log and in ntops alerts stating

Host x.x.x.x is possibly under scan attack [65536 active flows]

And then a short while later

Host x.x.x.x. is no longer under scan attack [65536 active flows]

Can anyone explain what it means and what I need to do to stop it ?
Thanks

]]>https://forum.netgate.com/topic/111608/ntop-flow-floodsRSS for NodeFri, 10 Apr 2026 23:22:08 GMTMon, 13 Feb 2017 22:45:36 GMT60<![CDATA[Reply to Ntop - Flow Floods on Sun, 23 Jul 2017 20:51:51 GMT]]>Seeing the same error. The IP is behind the firewall so this could only be happening from an internal IP, maybe the bridge?
Any possibility to see what source IP triggered this?

]]>https://forum.netgate.com/post/712880https://forum.netgate.com/post/712880Sun, 23 Jul 2017 20:51:51 GMT