Port Scan from major public domain

[blubomber]

I am running microsofts ISA server 2000 as my firewall,gateway, router to connect my works network to the internet via DSL line. Ever other day or so, it will record a port scan. Some times the scan will come from our ISP, and i have gotten scans from microsoft and yahoo to name some big ones. I use neotrace to trace the IP address and all the registration info for the end node points to the main domains.

Is this normal? Some of the port scans have come from one of our ISPs DNS servers.

Thank you for any help and guidance.

[Mntsnow]

Yep it's fairly normal to get some port scans. Now if they are hard hitting and the full port list scans then I would suggest contacting the Admin of the domain that the scan is supposedly coming from. Include the Data, Time (timezone info if not giving them GMT) and the IP and a snippet of your logs showing them what was happening. Most will get back to you with some sort of resolution or explaination.

[blubomber]

Thanks MntSnow. I thought that might be the case, i just wanted to be sure. And they all have been just one or two port scans coming from the same IP, so i did not see a need at this time to notify the Sys Admin at those sites.

Thanks again for the reply.