topic Re: Detected Sweep Scan originating from source: internal server - destination: empty in Firewall and Security Management

Detected Sweep Scan originating from source: internal server - destination: empty

RuneSeeker — Fri, 22 Aug 2025 07:16:50 GMT

Hi everyone,

We are currently running R81.20 Hotfix Take 105.

The IPS protection flagged a Sweep Scan originating from an internal server, with the destination showing as "null" and the service listed as HTTP_proxy (TCP/8080).

After 9 seconds, the system automatically applied a SAM rule to drop the connection. This action inadvertently disrupted legitimate communication with another internal server.

Once we identified the cause, we removed the affected server from the SAM rule, and since then the issue has not reappeared.

Could you help us understand what might be triggering this behavior?

Re: Detected Sweep Scan originating from source: internal server - destination: empty

PhoneBoy — Fri, 22 Aug 2025 22:10:02 GMT

We'd likely need to set up debug and reproduce the issue to understand the root cause of it.
This will require TAC assistance.

However, adding an exception is probably the best way to ensure this issue doesn't happen again.

Re: Detected Sweep Scan originating from source: internal server - destination: empty

RuneSeeker — Mon, 25 Aug 2025 08:25:38 GMT

Thank you for the reply,

Exceptions are configured in place long time ago. This issue was once-off, unexpected incident.
It's not clear how to reproduce this incident since we don't have any possible destination or what tool or process initiated that.

Do you have any suggestions?

Re: Detected Sweep Scan originating from source: internal server - destination: empty

PhoneBoy — Mon, 25 Aug 2025 18:10:07 GMT

I don't believe enough information is logged to understand what happened in this case.
Thus, we'd likely need to reproduce it in order to properly debug it.

Re: Detected Sweep Scan originating from source: internal server - destination: empty

RuneSeeker — Tue, 26 Aug 2025 09:41:42 GMT

Thanks for the assistance. We will update as more information becomes available.