Hello,
Firstly, i apologize for my english. I'm french so be forgiving.
I have a "problem" with my Symantec Endpoint Protection. We have thirty servers , and all of them have SEP.
The ip of the SEP server is 10.53.1.8.
All the others servers are in the same ip range.
And when i'm going on an other server (example 10.53.1.100) there is a message who said that the client will block the traffic from 10.53.1.8 for 600 seconds.
In french the exact message is : Le clients va bloquer le trafic provenant de l'adresse IP 10.53.1.8 pendant les 600 prochaine seconde( de XX/XX/XXXX 12:11:18 à XX/XX/XXXX 12:21:18)
In english i can't be sure but by translation it's : "The client will block traffic from the IP address 10.53.1.8 during the next 600 second".
I don't understand why the SEP server want to scan the ports of the others servers. I launched a scan on it to be sure there is no virus (it's not done yet) but i don't think he's infected.
We also have a serious trouble with our network, so i asking myselft if this message is not the source of those problems.
Thank for your help.