Endpoint Protection

I put a wireless router at one of my locations.  Now all of the clients there keep getting this notification.

Symantec Endpoint Protection
Traffick from IP address 10.115.11.225 is blocked from 4/13/2009 8:37:58 AM to 4/13/2009 8:47:58 AM.
Denial of Service is logged


What is this and how do I get rid of the error message?  It doesn't seem to be affecting them acquiring an IP address, but the message keeps popping up.

Hi,

Is the above mention IP i.e. 10.x.x.x is of your Wireless router??

Rgrds,
SAM

Also you can disble the notification from SEPM, but the very first thing is to understand the above IP.

If its not of your router then you need to check this IP. There could be a possibility of DOS attack getting broadcast from this machine,.

Rgrds,
SAM

There are several posibilities:

- maybe the access point is mulfunctioning
- the quality of frequency is too low, due to long distance
- the access point is providing a non-authorised service such as DHCP
- the access point is scanning something like ports or all the IPs, so that it is behaving like an attacker

Check out the IPS logs, maybe you find the reason among the logs

Yes, that is the IP of the wireless router that I put in.  The router works fine, it just seems Symantec thinks it's an attack.  I need to know how to disable that notification.

The AP is brand new out of the box... and 200 miles away.  And due to economic restrictions, I can't just go throwing money at it to get a new one, not matter how inexpensive they are.  It's a Linksys and I've checked and rechecked the settings and it's configured correctly.  But I can't tell what kind of packets it's sending.  How would I check that?

Or can't I just block the message so the users don't keep getting it???

I cant see why not. Also do check the AP for broadcast messages that may be emanating out of the AP. 

Anyone know how to supress the message?

I think you should allow it or make it trusted since it's coming from your router..

Paul it seems to be dangerous to exclude the IP, although it may be the last solution.

Michell, turn on the tracing log for your IPS. You can see what kind of aggressive transaction your Access Point is performing. In addition let us know your A/P blueprint and configurations detailed as possible.

Is there an entry for the router on your AD?

I've seen the same problem with other Linksys routers... upgrading the firmware on them generally fixes the issue.

Thank you Paul... that's exactly what fixed the problem.

Paul Thank you for the Solution i was facing this issue too.