https://community.cisco.com/t5/network-security/tcp-and-udp-portscans/m-p/5335505#M1123015 <P>Balaji</P><P>Thanks for the response. An example of this is one of my hosts did a portscan when accessing google.com. I can see the Intrusion event for this. Maybe my port scan detection is misconfigured?</P><P>Your thoughts?</P> Thu, 02 Oct 2025 17:07:39 GMT ethutchinson 2025-10-02T17:07:39Z https://community.cisco.com/t5/network-security/tcp-and-udp-portscans/m-p/5335394#M1123010 <P>I have two FTD 1140ns managed by an FMCv. Both are running 7.6.2. I enabled portscannig in detection mode some time ago. I noticed quite a few of my local IP addresses scanning out to Outside (public) addresses. I know this is a nubie type of question but is this normal behavior? I can understand the inside IP addresses scanning because of the OS, programs installed, etc.and I can know I can ignore outgoing scans from these internal subnets. Could this amount of portscans be pointing to an issue?</P><P>Any ideas or am I overthinking this.</P> Thu, 02 Oct 2025 12:24:48 GMT https://community.cisco.com/t5/network-security/tcp-and-udp-portscans/m-p/5335394#M1123010 ethutchinson 2025-10-02T12:24:48Z https://community.cisco.com/t5/network-security/tcp-and-udp-portscans/m-p/5335471#M1123014 <P>Why would an internal IP scan the internet world? This looks suspicious until you have a security team investigating any issues or scanning for requirements.</P> <P>If not, you need to examine the endpoint; why is it scanning over the internet?</P> <P>Even if local scanning takes place, they should only use RFC 1918 addresses for scanning, not the Internet range.</P> Thu, 02 Oct 2025 15:09:33 GMT https://community.cisco.com/t5/network-security/tcp-and-udp-portscans/m-p/5335471#M1123014 balaji.bandi 2025-10-02T15:09:33Z https://community.cisco.com/t5/network-security/tcp-and-udp-portscans/m-p/5335505#M1123015 <P>Balaji</P><P>Thanks for the response. An example of this is one of my hosts did a portscan when accessing google.com. I can see the Intrusion event for this. Maybe my port scan detection is misconfigured?</P><P>Your thoughts?</P> Thu, 02 Oct 2025 17:07:39 GMT https://community.cisco.com/t5/network-security/tcp-and-udp-portscans/m-p/5335505#M1123015 ethutchinson 2025-10-02T17:07:39Z https://community.cisco.com/t5/network-security/tcp-and-udp-portscans/m-p/5335529#M1123019 <P>not sure we need to know more information and how this was configured.</P> Thu, 02 Oct 2025 18:06:06 GMT https://community.cisco.com/t5/network-security/tcp-and-udp-portscans/m-p/5335529#M1123019 balaji.bandi 2025-10-02T18:06:06Z