IPS iSCSI warnings.

Options
jef
jef Posts: 87  Ally Member
First Comment Second Anniversary
edited June 22 in USG FLEX H Series

What is this warning telling me?
I am familiar with both the source and the destination machines.

Is this reporting that the source "192.168.11.13" is doing something to the destination that is harmful or unwanted?

I am very familiar with the source, and I would like to assume it is clean an safe.
What is IPS detecting exactly?

IPS-iSCSC.png

the above has over 900 warnings stacked. So, I don't want to dismiss it, I'd like to understand it. When i google the iSCSI / iSNS it doesn't help me understand my scenario.

«1

All Replies

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,317  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula

    Hi @jef ,

    To look up information about any IPS Signature ID, please refer to this link, enter the Signature ID, and click Search.

    https://threatintelligence.zyxel.com/idp

    Zyxel_Judy

  • jef
    jef Posts: 87  Ally Member
    First Comment Second Anniversary

    I had already done that, if you click in application, on the signature it opens the signature explaination.
    But, it doesn't tell you what you need to know as an Admin, it explains why it is a signature IPS issue.

    I scanned the source IP box and it returned clean, multiple times.
    So I am confused at what the IPS alarm is all about and what triggered it.

    What triggered it. If the source is known, and the source doesn't have any malware.
    Why is the error being thrown.

  • jef
    jef Posts: 87  Ally Member
    First Comment Second Anniversary

    This tells me to? Yes the source IP server is Linux and the Destination is AWS linux.

    Why does IPS think the source is attacking the destination??

    Screenshot from 2025-06-23 16-31-35.png
  • Zyxel_Judy
    Zyxel_Judy Posts: 2,317  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula

    Hi @jef ,

    I scanned the source IP box and it returned clean, multiple times.

    Could you please share the details about the tool and steps you used to scan the source IP (192.168.11.13) and confirm that it returned clean results?

    Zyxel_Judy

  • jef
    jef Posts: 87  Ally Member
    First Comment Second Anniversary
    edited June 27

    I did a "freshclam" to update the Signatures, then I ran the scan.
    I didn't take a "before" picture of the freshclam, because I didn't think to until after the scan finished.
    But you get the Idea.

    Step 1. Fresh Signature files.

    freshClam.png

    Step 2. Let it run from root for an hour and a half. Done… No Infected files.
    Errors 1207, logs show are empty files and symbolic links or active system files under permission lock.

    fullScanClam.png

    Ip4.png
  • Zyxel_Melen
    Zyxel_Melen Posts: 3,514  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @jef

    Thanks for the information. We did a lab to use "freshclam" but our USG FLEX H didn't detect the abnormal activity. To investigate this further, could you help to collect below info?

    1. Please help to capture this server's packet from the LAN interface. Please
      1. Select the packet capture item to edit it. image.png
      2. Change the capture condition and apply. image.png
      3. Click the capture button to start capturing. image.png
    2. Update the linux server's clamav database.
    3. Capture/screenshot the event log again once the device display the block log. In the mean time, stop capture packet.
    4. Provide the screenshot and the packet to us. You may send it to me via private message.

    Thanks!

    Zyxel Melen


  • jef
    jef Posts: 87  Ally Member
    First Comment Second Anniversary
    edited July 2

    I will, but the "Security Services" "IPS Trial" has ended.
    I assume without a valid license it is not scanning signatures anymore.
    I will send you the pkt capture and screenshot when the scan completes.

    Screenshot from 2025-07-01 19-35-18.png Screenshot from 2025-07-01 21-07-25.png

    the 12 "found" are not "infected" per se, they flag because they exceed the files size.

    Screenshot from 2025-07-01 21-44-01.png
  • Zyxel_Melen
    Zyxel_Melen Posts: 3,514  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate

    Hi @jef,

    Thanks for the information and packet. We will check these information first.

    Zyxel Melen


  • jef
    jef Posts: 87  Ally Member
    First Comment Second Anniversary

    How do I know which machine, "Source" or "destination, to focus on from this information?
    From this

    IPS-iSCSC.png

    If this is Packet Inspection, could we get more information than the above.
    What exactly raised this error. which direction, anything more would be useful.

    The "Source" isn't running iSCSI. Nor is it public facing.
    The "Destination" is ipsec VPN, also not public facing.
    Not sure if it is running iSCSI it is privately hosted by a vendor.

    The question I would most like answered is: Is this an Attack, or a Vulnerability warning?

  • Zyxel_Melen
    Zyxel_Melen Posts: 3,514  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    edited July 10

    Hi @jef,

    The question I would most like answered is: Is this an Attack, or a Vulnerability warning?

    After checking, we assume this could be a false detection and are checking with our partner. In the meantime, we want to check the version of your ClamAV. Could you help to use this command to collect the version?

    #clamscan -V

    Here is our lab's version:

    └──╼ #clamscan -V
    
ClamAV 1.0.7/27694/Wed Jul  9 16:42:34 2025

     Thanks!

    Zyxel Melen


Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）