https://community.cisco.com/t5/network-security/ips-reports/m-p/2983368#M43442 <P>There are several possibilities here but the top two things that come to mind are:</P> <P>1. The actual host on the inside of your network is doing the attack</P> <P>2. The attacker is using a spoofed IP</P> <P>Are you able to drill more into the event and investigate and correlate the events?</P> <P><EM>Thank you for rating helpful posts!</EM></P> Mon, 21 Nov 2016 20:19:32 GMT nspasov 2016-11-21T20:19:32Z https://community.cisco.com/t5/network-security/ips-reports/m-p/2983367#M43441 <P>The attacks blocked by IPS even shows internal IP addresses... Why is that so? Can some help me understand this?</P> Sun, 10 Mar 2019 13:42:55 GMT https://community.cisco.com/t5/network-security/ips-reports/m-p/2983367#M43441 Reshma Raje 2019-03-10T13:42:55Z https://community.cisco.com/t5/network-security/ips-reports/m-p/2983368#M43442 <P>There are several possibilities here but the top two things that come to mind are:</P> <P>1. The actual host on the inside of your network is doing the attack</P> <P>2. The attacker is using a spoofed IP</P> <P>Are you able to drill more into the event and investigate and correlate the events?</P> <P><EM>Thank you for rating helpful posts!</EM></P> Mon, 21 Nov 2016 20:19:32 GMT https://community.cisco.com/t5/network-security/ips-reports/m-p/2983368#M43442 nspasov 2016-11-21T20:19:32Z