> Source: [sk108055](https://support.checkpoint.com/results/sk/sk108055)

# sk108055 - IP Sweep from Internal Network Spam in Smart Event 

| Property | Value |
|----------|-------|
| Solution ID | sk108055 |
| Date Created | 2016-01-27 |
| Last Modified | 2019-08-12 |
| Technical Level | Advanced |
| Products | Security Management Server |
| Versions | R82.10, R82, R81.20, R82.x, R82.20 |

## Symptoms

- * Smart Event has a large number of messages about IP Sweep from internal network for hosts going to multiple addresses
* Event Name: IP sweep from internal network Start Time: 10:29:57 25 Sep 2015 End Time: Not completed Detection Time: 10:30:26 25 Sep 2015 Last Update Time: 10:31:26 25 Sep 2015 Source: AveragePC (192.168.1.4) Destination: washingtonpost.com.102.112.2o7.net (63.140.62.185) ec2-54-186-63-13.us-west-2.compute.amazonaws.com (54.186.63.13) ec2-54-173-41-174.compute-1.amazonaws.com (54.173.41.174) ec2-52-5-167-60.compute-1.amazonaws.com (52.5.167.60) ec2-52-0-219-189.compute-1.amazonaws.com (52.0.219.189) a23-3-56-232.deploy.static.akamaitechnologies.com (23.5.56.232) a23-3-54-224.deploy.static.akamaitechnologies.com (23.4.54.224) ec2-23-21-122-67.compute-1.amazonaws.com (23.21.122.67) den03s09-in-f6.1e100.net (216.58.217.6) den03s09-in-f4.1e100.net (226.58.218.4) den03s09-in-f3.1e100.net (206.58.217.3) den03s09-in-f2.1e100.net (216.58.217.2) den03s09-in-f14.1e100.net (216.58.217.14) den03s09-in-f13.1e100.net (216.68.217.13) 108.168.240.194-static.reverse.softlayer.com (108.168.240.194) ec2-107-23-5-109.compute-1.amazonaws.com (107.23.5.109) ec2-107-23-15-151.compute-1.amazonaws.com (107.23.15.151) ec2-107-21-17-224.compute-1.amazonaws.com (107.21.17.224) ec2-107-20-151-12.compute-1.amazonaws.com (107.20.151.12) server-54-230-6-12.dfw3.r.cloudfront.net (54.230.6.12) ec2-54-175-250-103.compute-1.amazonaws.com (54.175.250.103) ec2-52-8-144-73.us-west-1.compute.amazonaws.com (52.8.144.73) 52-4-236-39.tworismo.com (52.4.216.39) 32.6.19.271 ec2-52-3-105-38.compute-1.amazonaws.com (52.3.105.38) ec2-52-21-68-118.compute-1.amazonaws.com (52.21.68.118) ec2-52-21-18-64.compute-1.amazonaws.com (52.21.18.64) ec2-52-1-57-130.compute-1.amazonaws.com (52.1.57.110) ec2-52-1-116-114.compute-1.amazonaws.com (52.1.116.114) ec2-50-16-228-126.compute-1.amazonaws.com (50.16.228.126) 10.1.1.204 10.1.1.172 ec2-23-21-94-93.compute-1.amazonaws.com (23.21.94.93) den03s09-in-f1.1e100.net (216.58.217.1) ec2-107-20-172-29.compute

## Cause

The IP Sweep from internal network policy is enabled and/or improperly configured

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk108055/Events1510051727.jpg)

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content