Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an IPS in place and it's constantly triggering ICMP / Ping flood signatures between workstations and AD server; or AD to workstation. I understand that ICMP is used for AD authentication. However, the odd thing is that the count per event is quite high. Around 10,000 and above for one single event.

I constantly check on these workstations and AD; all seems to be fine. Nothing suspicious found and endpoint protection working fine.

What does the high count mean? Could it be false positive?

share|improve this question

closed as not a real question by Jeff Ferland Aug 30 '12 at 17:41

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

Can you add some logs and the actual ids alert into your question? Give few source, destination IPs and system versions. You can hide your real IP info, alter your real IPs and post. – Kapish M Jul 3 '12 at 10:05
Maybe its some sort of ICMP redirect or something – Andrew Smith Jul 3 '12 at 12:01
This kind of diagnosis requires some real data attached. This could easily be a faulty rule, such as tracking on destination IP, or misinterpretation of the data, in the case of event aggregation. – Scott Pack Jul 3 '12 at 13:40
No further comment from the asker for months, unanswerable without further details. – Jeff Ferland Aug 30 '12 at 17:41