In my Amazon EC2 I installed a snort to prevent the attacks. I observed some logs TCP Port Scan Source IP is ISP and destination IP is I think is used for in a local network (routing, broadcast) and etc.

But how this scanning is possible when destination IP is and how it was reached to my instance?


Anytime you see the address used in the victim IP address field it can be the result of multiple victim IP addresses being summarized.


If you also do packet capture, go look at the packets and see what the traffic was. We all know snort gets easily confused relatively easily by legitimate traffic that it doesn't understand, but by looking at the original packets it should get clearer.

If you don't run packet capture, then, for a while try running a Wireshark capture and filter for all traffic with ip.dst== to see if you can catch it recurring. This will give an idea of what type of traffic is occuring with those properties.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.