On 02/02/2010 16:51, Kathy wrote:

> Application event log on sbs 2003 (patched to date) with ISA 2004 is filling
> up with the following warnings every 10 seconds :
>
> Microsoft Firewall
> Packet filter
> Event id: 15108
> ISA Server detected a spoof attack from Internet Protocol (IP) address
> 192.168.2.4. A spoof attack occurs when an IP address that is not reachable
> via the interface on which the packet was received. If logging for dropped
> packets is set, you can view details in the packet filter log.
>
> Often the address listed is 0.0.0.0, but can be almost any subnet (including
> our own)
>
> This seems to coincide with VPN access, of which there is a great deal.
> Sometimes ISA seems to terminate the connection, also.
>
> I've read KB840681, but it doesn't seem to apply as the Causes section
> doesn't apply and there are no other internal networks. The server has a
> Lights Out board, but it's disabled.
>
> ISA BPA reports no errors.
>
> Any ideas?

Does this help:

http://www.eventid.net/display.asp?e...ontrol&phase=1