Assuming you meant SEP rather than Backup Exec.
This indicates that there is inbound traffic form the IP mentioned in the alert. As the user mentions, this is usually a malformed address or it is some sort of malware creating traffic.
There are some versions of SEP that see DNS traffic from the router as a DoS. This is typically found on a router that is doing DNS forwarding from an ISP. Common on home and small business devices.
Symantec Support has info on this and it is supposed to be addresed in a release RU6 MP1. Check your version to see if it is current.
You can create an exception but you would want to be sure the traffic is legitimate. This assumes a managed client.
To create an exception for Intrusion Prevention Policy to allow a specific ID:
- Open Symantec Endpoint Protection Manager console .
- Select 'Policies' tab.
- Under 'View Policies', select 'Intrusion Prevention'.
- Select Intrusion Prevention policy, and under 'Tasks' select 'Edit the Policy'.
- Select 'Exceptions' tab.
- Click on 'Add...' button.
- Search and select ID blocked.
- Click on 'Next>>' button.
- Change 'Action', from 'Block' to 'Allow'. Click on 'OK' button.
- Check if the exception edited has been added to 'Intrusion Prevention Exceptions' list.
- Click on 'OK' button for save changes in the Intrusion Prevention policy.