I set up a new laptop recently and, after installing various developer tools, it started causing our Sonicwall firewalls to issue an alert email whenever the laptop connected to the network. The message (with an artistically modified source IP) was:
"Alert - Intrusion Prevention - Smurf Amplification attack dropped - 192.168.1.19, 8, X1 - 255.255.255.255, 8 "
It only happened when the NIC card was enabled and/or when the laptop started up.
We went through various attempts to run TCPView on the laptop, searching for port 8 traffic as well as monitoring the Sonicwall appliance for spurious traffic and couldn't narrow it down. We booted to the Microsoft Security Sweeper CD and ran scans, ran Malware Bytes, etc. trying to figure out if some malware had gotten on the system, but all came up clean.
One thing we noticed when running TCPView was that the system appeared to be listening on port 80. I initially dismissed it as I'd installed Visual Studio 2010 and figured IIS Express or the like was probably running. Last night, however, I right-clicked on a folder in Explorer and noticed an option to insert an XSP Web Server there. A quick Google search clued me in as to what XSP was and that it was part of the MonoDevelop IDE that was recently installed to explore Mono development.
This morning I uninstalled MonoDevelop and restarted the laptop and - no warning email from the Sonicwall appliance came.
I wanted to get this info out there so that others that are suddenly battling with their IT department over a "potentially compromised system" can get a heads up on one possibility for the alerts. I'm also curious to know what XSP (or MonoDevelop?) is doing upon network initialization that incurs the Sonicwall's wrath.
Edit: Striking out the above. Apparently it wasn't XSP Server causing the issue as it is still happening when connecting to the network. Modified the title of the question to reflect this.