Attack against the server

Hello Netman:

I believe my server is under an security attack.  Some is using the names mark, justin, jennifer in trying to logon to the FTP site.  The attack shows up as a Event 529 and happens ever few minutes until I shut down the FTP site.  Any suggestions on how to stop the attack?

Thanks

Steve
huntersp3Asked:
Who is Participating?
 
rhandelsCommented:
Try to see where it is originating from. Do you have a firewall between your FTP server and the outside world, check the originating IP address and block it on your firewall.

If this is internal, then go to the FTP logs (should be in the %Systemroot%\system32\logs directory) to see who is logging on to the machine..

You should always take into account that this can be a user who is trying to log in but simply is stupid enough to type in a wrong username (long shot, but you never know..)
0
 
huntersp3Author Commented:
The logs files did the trick and I have blocked the IP Address.  Thanks for the help!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.