Abstract: A method and system for protecting a computer network against unauthorized users probing computer networks for vulnerabilities. The method comprises monitoring a computer network for communications from Internet protocol addresses directed toward unused Internet protocol addresses within the computer network. Internet protocol addresses sending communications directed toward unused Internet protocol addresses within the computer network are recorded as violators. Counter measures are initiated against Internet protocol addresses recorded as violators protecting the computer network from intrusion. The system comprises a monitoring means monitoring communications sent locally in response to communications from Internet protocol addresses to local Internet protocol addresses within a computer network. A recording means records Internet protocol addresses attempting to send communications to unused local Internet protocol addresses.