# "McAfee has intercepted a port scan attack!"

**URL:** <https://boards.straightdope.com/t/mcafee-has-intercepted-a-port-scan-attack/140028>\
**Category:** Factual Questions\
**Created:** [December 2, 2002, 8:25pm UTC](https://boards.straightdope.com/t/mcafee-has-intercepted-a-port-scan-attack/140028 "2002-12-02T20:25:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![KenP](https://avatars.discourse-cdn.com/v4/letter/k/c0e974/32.png) [@KenP](https://boards.straightdope.com/u/KenP)\
**Post date:** [December 2, 2002, 8:25pm UTC](https://boards.straightdope.com/t/mcafee-has-intercepted-a-port-scan-attack/140028/1 "2002-12-02T20:25:14Z")

</div>

I get this message several times a week from McAfee Firewall. What (if anything) am I supposed to do about it? Or is it just McAfee’s way of telling me that it’s working?

p.s., I have searched their Help system, and found nothing useful.

---

<div class="post-metadata">

**Author:** ![Larry\_Mudd](https://avatars.discourse-cdn.com/v4/letter/l/f14d63/32.png) [@Larry\_Mudd](https://boards.straightdope.com/u/Larry_Mudd)\
**Post date:** [December 2, 2002, 9:50pm UTC](https://boards.straightdope.com/t/mcafee-has-intercepted-a-port-scan-attack/140028/2 "2002-12-02T21:50:17Z")

</div>

If it’s usually from the same IP, you can probably block that IP and you won’t be bothered as much.

---

<div class="post-metadata">

**Author:** ![c\_goat](https://avatars.discourse-cdn.com/v4/letter/c/f4b2a3/32.png) [@c\_goat](https://boards.straightdope.com/u/c_goat)\
**Post date:** [December 2, 2002, 10:16pm UTC](https://boards.straightdope.com/t/mcafee-has-intercepted-a-port-scan-attack/140028/3 "2002-12-02T22:16:07Z")

</div>

I wouldn’t really call it an “attack”, the firewalls get a little dramatic. But yeah, it’s basically McAfee telling you it’s working. Some bad person is looking for infected computers with backdoor programs (ie: SubSeven,BackOrifice,etc.) Your McAfee intercepted it, and made it look like your computer wasn’t even there.

So there’s nothing to worry about really. I get the same messages from Norton all the time. I think you can probably turn off the reporting of them, but you definitely want McAfee to continue blocking it.

---

<div class="post-metadata">

**Author:** ![Mr.Blue\_Sky](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@Mr.Blue\_Sky](https://boards.straightdope.com/u/Mr.Blue_Sky)\
**Post date:** [December 2, 2002, 10:40pm UTC](https://boards.straightdope.com/t/mcafee-has-intercepted-a-port-scan-attack/140028/4 "2002-12-02T22:40:44Z")

</div>

I get a similar warning from Zone Alarm, but I have told it to stop telling me about it. I can always check the log and see what’s been going on.