I have a new Exchange 2003 server with Groupshield 6.0 and VirusScan
8.0i running on it (up to date, of course) and one of my Cisco 4215 IDS
boxes is picking up traffic from it (port 8) to each of my AD Domain
Controllers (port 0!) and logging scores of intrustion alerts. I
suspect that it is legitimate traffic as the server is fully patched
and had never been on the network without fully up to date antivirus
running on it, and due to the fact that it's only sending the "suspect"
packets to my domain controllers; however, I can't find any information
online to support this. Does anyone know of any legitimate traffic
where source is port 8 on and Exchange server and the destination is
port 0 on all Domain Controllers?