Forum
we have both and IPS 4240 as well as one of the newer IPS 4345 IPS units in place at this specific customer site.
When I drill down into IME into Event Monitoring on the IPS 4345, I can see we are having multiple signature matches from
![IPS_UPnP Location Overflow.jpg](/legacyfs/online/legacy/1/7/1/158171-IPS_UPnP%20Location%20Overflow.jpg)
I have this configured currently for Actions to take as:
![actions.jpg](/legacyfs/online/legacy/2/7/1/158172-actions.jpg)
What I want to do is see if I can determine what workstation this is coming from. How would I be able to see the attacker packets which are logged?
I do not see a way in IME to view attacker packets. I think there used to be a way in the old IDM app to do this, but I am not sure how anymore?
Thanks in advance!