Is it possible to discover the internal server which is sweeping our network by the gateway Juniper Switch? Is it possible to discover the internal server which is sweeping our network by the gateway Juniper Switch? Our network topology is like this: ![enter image description here]( If the servers under access switch all are different users. there I have a problem, that is: if one of the servers DDoS attack all the servers under my network, how can I find it out? there if like this attack, there must through the gateway switch. So, how can I capture the source server?

> Is it possible to discover the internal server which is sweeping our network by the gateway Juniper Switch

Simple answer is possible. Simply you can find out source address by analyzing packets. But it will not much successful because if attacker knows how to sweep internal network from outside, he never ever use real IP address.

In addition to that, there are many ways to sweep inside network from outside. In my network i detect same situation and my firewall directly shows some ip address which trying to access my internal network. IP address from well reputed telecom company in my country we directly contact them and did inspection. But really what happened was there was virus inside my network It send to Internal Ip address to external source. Then outside firm try to access my network through fake ip address. Fortunately firewall blocked that request it was not allowed to access..