topic Reverse direction in threat logs in General Topics

Reverse direction in threat logs

das — Thu, 25 Apr 2013 21:38:31 GMT

When looking at the threat logs the vulnerability for spyware shows my servers as the attacker in the outbound direction. I have an inbound/outbound anti spyware policy and it caught jboss trying to access my network. Why does it show my servers as the attacker in the logs when the connection was initiated from the outside?

Re: Reverse direction in threat logs

wesa — Thu, 25 Apr 2013 21:44:18 GMT

Hello Das,

Is there any proxy involved on this traffic. Logs shows servers IP?

Re: Reverse direction in threat logs

das — Thu, 25 Apr 2013 22:05:57 GMT

There are no proxies that i know of.

Re: Reverse direction in threat logs

UhMayYeah — Thu, 25 Apr 2013 23:45:10 GMT

The Threat could be triggered by request or response packet.

Check the Direction in the session/ log details by clicking the magnifying glass icon alongside the log in question.

-Ameya