Results 1 to 3 of 3
  1. #1
    Newbie
    Join Date
    Jun 2019
    Posts
    12

    Default Unknown Source flagged

    I don't understand where or what this flagged intrusion prevention source is.

    In this network I have nothing at this address. This is a 12 seat license and I have 11 seats filled, static. Could anyone educate me on this? Thanks
    Attached Images Attached Images

  2. #2
    Untangle Ninja sky-knight's Avatar
    Join Date
    Apr 2008
    Location
    Phoenix, AZ
    Posts
    23,614

    Default

    The source doesn't lie, you had a device at that address. It also was trying to access the gateway... which is probably the DHCP server. If I had to throw a dart at the board, I'd say that's an IP phone looking for configuration details.
    Rob Sandling, BS:SWE, MCP
    NexgenAppliances.com
    Phone: 866-794-8879 x201
    Email: support@nexgenappliances.com

  3. #3
    Newbie
    Join Date
    Jun 2019
    Posts
    12

    Default

    I think you are right. I just realized there is a 5th IP phone that I have been unaware of - I can't yet verify the address. It shows up in the known devices list and was last seen on the date of that IPS flag. It doesn't show up on the DHCP lease list and I haven't figure out why that is yet, in fact I have 2 devices now that are known but do not show up on the lease list.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

SEO by vBSEO 3.6.0 PL2