6Oca
Local Scans initiated from a VLAN Broadcast IP address
Just reviewing some logs and I am seeing local scans to several local IP addresses on port 137 within my network. The source IP however is the broadcast IP of the VLAN (.255).
I have checked the logs and I can see the broadcast IP trying to initiate udp 137 connections on several other IP addresses of the same subnet.
Many of the errors being shown are "The Windows Filtering Platform has blocked a connection".
I cant really make sense of the Source IP address being the broadcast IP. Has anyone come across this before please? and from your experiences, where should I be looking that I could have missed? Thanks.
