Source :

Destination :

Both IP's do not belong to us. Direction was Inbound. How is this possible?

Then why are these IP addresses routed to my network ?

  • Where did you see it? On a boundary device or on an internal device? It is not unusual to see public IP's bouncing of your boundary devices. Jan 10, 2017 at 11:01

2 Answers 2


Scanning into your boundary devices from the public internet from unknown IP’s is normal behaviour. Everyone from government agencies, research and education institutes to the bad guys looking to do harm are continually scanning the internet for a variety of reasons.

If your boundary devices or alerting devices such as your IDS/IPS are fagging this up, it is up to you have you manage it. You can either allow them to continue to alert you or you can tune it out once you have deemed it to be benign.

In my experience it is typical for denied connections on boundary devices to be tuned out of alerting tools such as SIEM or IDS/IPS.

If it isn’t benign, then you will want/need to take the appropriate remediative action as per your incident response plan. So for example; If IP’s within your network are being scanned from the public internet, then your IPS is doing its job correctly by alerting you are potential threat, a threat that you should investigate and take action on if needed.

  • Thank you for your response, But the source and destination of the incident did not belong to us. If source address spoofed, the destination should be us. Here I am observing different IP which does not belong to us.
    – user95437
    Jan 12, 2017 at 13:38

Could tcpreplay have been executed on a network interface for one of your IDS systems with a pcap file for testing purposes?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .