Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Ntop - Flow Floods

    Scheduled Pinned Locked Moved
    Traffic Monitoring
    2
    2
    1.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      TomT
      last edited by

      Hi

      I've noticed a few messages in pfsenses system.log and in ntops alerts stating

      Host x.x.x.x is possibly under scan attack [65536 active flows]

      And then a short while later

      Host x.x.x.x. is no longer under scan attack [65536 active flows]

      Can anyone explain what it means and what I need to do to stop it ?
      Thanks

      1 Reply Last reply Reply Quote 0
      • S
        sterlinggold
        last edited by

        Seeing the same error. The IP is behind the firewall so this could only be happening from an internal IP, maybe the bridge?
        Any possibility to see what source IP triggered this?

        1 Reply Last reply Reply Quote 0
        • First post
          Last post