Hey everbody,
I've got a strange IPS detection.
[HTML]2009:03:20-19:50:40 (none) barnyard[9004]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="BACKDOOR fkwp 2.0 runtime detection - connection success" group="510" srcip="192.168.178.1" dstip="192.168.178.93" proto="6" srcport="8110" dstport="1081" sid="6033" class="A Network Trojan was detected" priority="1" generator="1" msgid="0"
2009:03:20-19:50:40 (none) barnyard[9004]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="BACKDOOR fkwp 2.0 runtime detection - connection attempt server-to-client" group="510" srcip="192.168.178.1" dstip="192.168.178.93" proto="6" srcport="8110" dstport="1081" sid="6031" class="A Network Trojan was detected" priority="1" generator="1" msgid="0"[/HTML]
The strange is that the source and the destitionation IPs are in the same range! What does that mean? I always thought that traffic will got through my firewall and not be initiated from my firewall!
Could me anybody tell whats going on?
cheers
PSyc
This thread was automatically locked due to age.
