Yep, that would look like a scan, however, they missed the fact that this was 50 long running connections that passed the handshake and went on to pass data back and forth, i.e. a successful connection. I will pass it along. Thanks. -- corby From: <Aydelott>, "Ryan M." <[email protected]<mailto:[email protected]>> Date: Thursday, February 20, 2014 9:15 AM To: Corby Schmitz <[email protected]<mailto:[email protected]>> Cc: Dan Olson <[email protected]<mailto:[email protected]>>, "Devoid, Scott C." <[email protected]<mailto:[email protected]>>, Ryan Aydelott <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>, MCS Admins <[email protected]<mailto:[email protected]>> Subject: Re: banned from the lab network Sure thing, I had a pdsh session open to about 50vm's collecting some stats from a performance run. It would have just looked like a bunch of terminal/ssh traffic, but across 50 ip's Sent from my iPhone On Feb 20, 2014, at 8:56 AM, "Schmitz, Corby B." <[email protected]<mailto:[email protected]>> wrote: All: This should be undone. Ryan: Can you describe what you were doing at the time of the block? It might help prevent this kind of block in the future. -- corby From: <Murphy-Olson>, Dan Olson <[email protected]<mailto:[email protected]>> Date: Thursday, February 20, 2014 12:07 AM To: "Devoid, Scott C." <[email protected]<mailto:[email protected]>> Cc: Ryan Aydelott <[email protected]<mailto:[email protected]>>, "[email protected]<mailto:[email protected]>" <[email protected]<mailto:[email protected]>>, Dan Olson <[email protected]<mailto:[email protected]>>, MCS Admins <[email protected]<mailto:[email protected]>> Subject: Re: banned from the lab network 67.167.211.254