Symantec Endpoint Protection ReadyNAS Port Scan

Hi all,

Earlier I had an issue with lost network access: https://community.netgear.com/t5/Using-your-ReadyNAS/Readynas-526X-Network-Access-Whilst-Resync/m-p/1164297#M118852

I now know this to be due to the ReadyNAS being flagged as carrying out a Port Scan from Symantec logs:

It seems Symantec Endpoint Detection blocks the device due to a suspect port scan. See this in logs:

Somebody is scanning your computer.
Your computer's UDP ports:
61393, 61783, 50935, 57172 and 64028 have been scanned from 192.168.10.21.

Somebody is scanning your computer.
Your computer's UDP ports:
54855, 58387, 56777, 60113 and 54196 have been scanned from 192.168.10.21.

The client will block traffic from IP address 192.168.10.21 for the next 600 seconds (from 01/11/2016 17:03:22 to 01/11/2016 17:13:22).

According to: https://support.symantec.com/en_US/article.tech165237.html

The SEP firewall detects the behavior as port scan attack if the same IP address accesses more than 4 ports within 200 seconds.

It is not unknown for legitimate software to act in a way which triggers this event. (It all comes down to the way in which the software is designed to function and communicate.) Administrators should monitor their networks and grow to recognize what is expected and unexpected within their domain. 

I raised case 27614721 for this issue... They are keeping it in monitoring with a view to closing it. However, I feel there is value in this being investigated as this has the potential to affect many users. Ideally the port scan activity should be halted.

Thanks...