Intrusion Prevention

tcp_port_scan

Description

This indicates the rate of TCP packet from an IP address is above specified threshold level.
This indicate a possible port scan attack that is one of the most common and most well understood techniques for discovering and mapping services that are listening on a specified port on a target host. It is typically used by attackers to gather information about the target so as to plan the attack approach.

Affected Products

Any unprotected system that is connected to the Internet and provides TCP-based services

Impact

Information Disclosure

Recommended Actions

Examine the source IP host for the cause of the traffic.