MS-SQL_NullPacket false positive ??

Attempted Intrusion "MSSQL_Null_Packet_DoS" against your machine was detected and blocked.
Intruder: machinename.mydomain.com(192.x.x.x)(ldap(389)).


My Symantec Client firewall keeps popping up this and I'm sure it's a false positive because I don't have an SQL server at the IP that it says is generating the attack?

Has anyone seen this happen before and why would a w2003 server generate it, or at least generate something that looked like it? There are no events at the same time generated on the source machine.

Thanks

Quote:

---

My Symantec Client firewall keeps popping up this and I'm sure it's a false positive because I don't have an SQL server at the IP that it says is generating the attack?

---

Just because you don't have it doesn't mean that someone won't attempt to scan for it or that a worm won't attempt to propogate. It's just telling you what it thinks it found. This is a good thing since it's detecting it (that job of an IDS)

Quote:

---

Has anyone seen this happen before and why would a w2003 server generate it, or at least generate something that looked like it? There are no events at the same time generated on the source machine.

---

It's very possible that the source address was "spoofed" (faked). Is this coming from an external source or internal network? Either way, if you want more details you'd need a sniffer to see the full packet (something like Ethereal might be handy). Honestly, however, if this is coming from external sources (outside your network) I wouldn't worry about it.

The port "under attack" is not the SQL Server port, (1433), it's the LDAP port, (Lightweight Directory Access Protocol). It's probably some kind of worm or bot just firing these packets looking for unfirewalled Win2k/XP boxes to see what it can find. Since it's being blocked I would forget about it.

Well, since it's on your network ( machinename.mydomain.com(192.x.x.x) ) I'd make sure that someone responsible for the network you use checks out that machine. If Tiger Shark is right, is has at least one worm running on it, and therefor should be considered a security risk. It probably need some patches or other updates.