Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

We have an IPS in place and it's constantly triggering ICMP / Ping flood signatures between workstations and AD server; or AD to workstation. I understand that ICMP is used for AD authentication. However, the odd thing is that the count per event is quite high. Around 10,000 and above for one single event.

I constantly check on these workstations and AD; all seems to be fine. Nothing suspicious found and endpoint protection working fine.

What does the high count mean? Could it be false positive?

share|improve this question
1  
Can you add some logs and the actual ids alert into your question? Give few source, destination IPs and system versions. You can hide your real IP info, alter your real IPs and post. – Kapish M Jul 3 '12 at 10:05
Maybe its some sort of ICMP redirect or something – Andrew Smith Jul 3 '12 at 12:01
1  
This kind of diagnosis requires some real data attached. This could easily be a faulty rule, such as tracking on destination IP, or misinterpretation of the data, in the case of event aggregation. – Scott Pack Jul 3 '12 at 13:40
No further comment from the asker for months, unanswerable without further details. – Jeff Ferland♦ Aug 30 '12 at 17:41

closed as not a real question by Jeff Ferland♦ Aug 30 '12 at 17:41

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

Browse other questions tagged or ask your own question.