MAC address blocked after a portscann

[Charles Michaud]

Hi,

Since I portscanned (a lot)my "trusted" HP-UX B.11.00 workstation from my linux station with nmap, all TCP packets from the linux station are filtered/blocked.

Now, "nmap -sT" shows me every open ports as filtered, event no-inetd port, but only from the linux station, I also tried it from other systems and everything works fine.

The linux staion dont have any firewall or intrusion detection system and it was able to communicate with the HP-UX box before I used it to portscann heavily.

I changed the Linux ip's but TCP packets from it are always blocked.

Is it possible than a trusted HP-UX system have some kind of IDS that will automaticaly block packets/frame with L2 rules from "abusing" node?

If yes, how to disable it and/or to flush rules ?

If no, do you have any clue of whats going on here?

Thanks

[Michael Steele_2]

Not sure but if you delete out all of your MAC's in the arp table then it can take a while to rebuild or repopulate with the lost MAC's. For example, ever see all the messaging a default gateway puts out about 'who knows so and so'?

See what 'arp -a' reveals before and after your port scan.

A trusted system by the way, has nothing to do with networking, its more akin to user accounting and user audit trails.

Get a copy of 'tcpdump', 'etheral' or another network monitoring utility and observe all the message traffic going on.

http://hpux.cict.fr/hppd/hpux/Networking/Admin/tcpdump-3.6.2/