Source : 252.205.75.128
Destination : 220.127.116.11
Both IP's do not belong to us. Direction was Inbound. How is this possible?
Then why are these IP addresses routed to my network ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Scanning into your boundary devices from the public internet from unknown IP’s is normal behaviour. Everyone from government agencies, research and education institutes to the bad guys looking to do harm are continually scanning the internet for a variety of reasons.
If your boundary devices or alerting devices such as your IDS/IPS are fagging this up, it is up to you have you manage it. You can either allow them to continue to alert you or you can tune it out once you have deemed it to be benign.
In my experience it is typical for denied connections on boundary devices to be tuned out of alerting tools such as SIEM or IDS/IPS.
If it isn’t benign, then you will want/need to take the appropriate remediative action as per your incident response plan. So for example; If IP’s within your network are being scanned from the public internet, then your IPS is doing its job correctly by alerting you are potential threat, a threat that you should investigate and take action on if needed.