Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Hackers

Posted on 2006-11-29
5
Medium Priority
?
284 Views
Last Modified: 2010-04-18
Someone is really trying to get into my server. When I look at the event log it looks like its several different people from several different IP addresses from all over the world, but the usernames are consistent which makes me think its one person only. its not the usual administrator/password combination but a username that makes me think this person knows me. I dont know too much of hacking, how is it possible though that the IP addresses/workstations are always different? Am I just wasting my time blocking those IPs one by one? Is there a way to find out who is he/his real IP address? Or what can I do? Any suggestions?
0
Comment
Question by:Cubbybulin
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 
LVL 11

Expert Comment

by:Chris Gralike
ID: 18037756
Instead of the IP he is using (wich might and most prob will be public proxy), why dont you block the port he is opperating on.

Or if you have IDS available you can try and find certain signatures in the packets. There is bound to be client information in the header of the tcp packets. But thats far streached for most...
0
 

Author Comment

by:Cubbybulin
ID: 18037810
It says: Source Port: 0
We dont have IDS - what is a good one/good price? Thanks! Is there a program that could find him?
0
 
LVL 26

Accepted Solution

by:
MidnightOne earned 1000 total points
ID: 18041913
Cubbybulin:

For free, it's hard to beat Snort. http://www.snort.org/

HTH

MidnightOne
0
 
LVL 11

Assisted Solution

by:Chris Gralike
Chris Gralike earned 1000 total points
ID: 18053014
Snort is indeed a verry good choice. Next to that, you can simply block port 0.

This is a common tactic in attempt to bypass the firewall wich "might" have a badly written rules in there. Most administrators dont realise there even "is" a port 0 and guess that port 1 is the first in the range.

Also on snort, you might need some basic linux knowledge and a switch / router / firewall that allows port forwarding..

-Regards,

0
 
LVL 11

Expert Comment

by:Chris Gralike
ID: 18053019
or a old fashion Hub that is ;-)
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

by Batuhan Cetin In this article I will be guiding through the process of removing a failed DC metadata from Active Directory (hereafter, AD) using the ntdsutil tool in a Windows Server 2003 environment. These steps are not necessary in a Win…
I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
This course is ideal for IT System Administrators working with VMware vSphere and its associated products in their company infrastructure. This course teaches you how to install and maintain this virtualization technology to store data, prevent vuln…
Please read the paragraph below before following the instructions in the video — there are important caveats in the paragraph that I did not mention in the video. If your PaperPort 12 or PaperPort 14 is failing to start, or crashing, or hanging, …
Suggested Courses

604 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question