tcp_port_scan
Description
This indicates the rate of TCP packet from an IP address is above specified threshold level.
This indicate a possible port scan attack that is one of the most common and most well understood techniques for discovering and mapping services that are listening on a specified port on a target host. It is typically used by attackers to gather information about the target so as to plan the attack approach.
Affected Products
Any unprotected system that is connected to the Internet and provides TCP-based services
Impact
Information Disclosure
Recommended Actions
Examine the source IP host for the cause of the traffic.
Telemetry
Coverage
IPS (Regular DB) | |
IPS (Extended DB) |