	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.3

Intrusion Detection Windows Server 2008

Asked by wn411 in Intrusion Detection Systems (IDS), Windows Server 2008, Networking Security Vulnerabilities

Tags: Attack, IDS, DDOS, Windows Server 2008

Hi, I am in the process of setting up a few servers. The hardware firewall as already setup with policies (Juniper SSG5) and I am also using the host based firewalls as well. I have not been on the servers for a week. So, I logged in today and found a bunch of failed logins on the windows event log. I then took a look the the firewall log and found the same IP over and over again.

I have remote desktop available only via a VPN connection. So how and what are they trying to log into?

This is the current firewall policy:

IID      Source      Destination      Service      Action
4      Untrust/Any      Global/MIP(76.xxx.xxx.200)      DNS
MS-WIN-DNS      Permit

This is the event I have pages of in the firewall:

Date/Time      Source Address/Port      Destination Address/Port      Translated Source Address/Port      Translated Destination Address/Port      Service      Duration      Bytes Sent      Bytes Received      Close Reason
2009-08-24 13:11:01      64.235.99.197:2656      76.xxx.xxx.200:135      64.235.99.197:2656      10.0.0.7:135      MSRPC ENDPOINT MAPPER(TCP)      0 sec.      0      0      Creation
2009-08-24 13:11:01      64.235.99.197:2567      76.xxx.xxx.200:135      64.235.99.197:2567      10.0.0.7:135      MSRPC ENDPOINT MAPPER(TCP)      0 sec.      0      0      Creation
2009-08-24 13:11:01      64.235.99.197:2504      76.xxx.xxx.200:135      64.235.99.197:2504      10.0.0.7:135      MSRPC ENDPOINT MAPPER(TCP)      0 sec.      0      0      Creation
2009-08-24 13:11:00      64.235.99.197:3809      76.xxx.xxx.200:135      64.235.99.197:3809      10.0.0.7:135      MSRPC ENDPOINT MAPPER(TCP)      12 sec.      1326      520      Close -

View the Solution FREE for 30 Days

20091118-EE-VQP-93 - Hierarchy / EE_QW_3_20080625

Hall of Fame

1. richrumble31,642
2. Phateon9,820
3. DaveHowe7,210
4. kenboonejr6,150
5. jfer0x016,000
6. decoleur4,350
7. LingerLon...4,000
8. dpk_wal3,750
9. bignewf3,500
10. MikeHolcomb3,100
11. xmachine3,064
12. arnold3,000
12. Goemanne3,000
14. ikalmar2,750
15. rsivanandan2,650
16. MikeKane2,500
16. uetian17072,500
18. Mestha2,450
19. astralcom...2,200
20. breadtan2,150
21. rcflyr2,040
22. Gns2,000
22. srappaport2,000
22. ehabsalem2,000
22. gheist2,000
22. JFrederic...2,000
22. asavener2,000
22. devinnoel2,000
22. ccomley2,000
22. snoopfrogg2,000
22. TheCaped...2,000
22. Paranorm...2,000
22. JosephGl...2,000
22. deimark2,000
22. granwizz...2,000
22. TurboBorl...2,000
22. oklit2,000
22. shijupaul...2,000
22. techzter2,000
22. Matkun2,000
22. arrow_r...2,000
22. Onkelt2,000
22. 3nerds2,000
22. askb2,000
22. jake_00112,000
22. andrewallen2,000
22. jodylemoine2,000
22. digichris832,000

1. richrumble44,642
2. rsivanandan16,540
3. PowerIT10,300
4. Phateon9,820
5. DaveHowe7,960
6. clearacid7,500
7. jahboite6,880
8. What906,700
9. hfraser6,640
10. dpk_wal6,345
11. kenboonejr6,150
12. jfer0x016,000
13. billwharton5,975
14. arnold5,500
14. shakoush...5,500
16. harbor2354,850
17. decoleur4,350
18. LingerLon...4,000
19. xmachine3,964
20. batry_boy3,900
21. Kelvin_King3,500
21. bignewf3,500
23. bbao3,350
24. MikeKane3,250
25. dpiniella3,200

Intrusion Detection Windows Server 2008

Asked by wn411 in Intrusion Detection Systems (IDS), Windows Server 2008, Networking Security Vulnerabilities

Tags: Attack, IDS, DDOS, Windows Server 2008

About this solution