Solved

Hackers

Posted on 2006-11-29
5
243 Views
Last Modified: 2010-04-18
Someone is really trying to get into my server. When I look at the event log it looks like its several different people from several different IP addresses from all over the world, but the usernames are consistent which makes me think its one person only. its not the usual administrator/password combination but a username that makes me think this person knows me. I dont know too much of hacking, how is it possible though that the IP addresses/workstations are always different? Am I just wasting my time blocking those IPs one by one? Is there a way to find out who is he/his real IP address? Or what can I do? Any suggestions?
0
Comment
Question by:Cubbybulin
  • 3
5 Comments
 
LVL 10

Expert Comment

by:Chris_Gralike
ID: 18037756
Instead of the IP he is using (wich might and most prob will be public proxy), why dont you block the port he is opperating on.

Or if you have IDS available you can try and find certain signatures in the packets. There is bound to be client information in the header of the tcp packets. But thats far streached for most...
0
 

Author Comment

by:Cubbybulin
ID: 18037810
It says: Source Port: 0
We dont have IDS - what is a good one/good price? Thanks! Is there a program that could find him?
0
 
LVL 26

Accepted Solution

by:
MidnightOne earned 250 total points
ID: 18041913
Cubbybulin:

For free, it's hard to beat Snort. http://www.snort.org/

HTH

MidnightOne
0
 
LVL 10

Assisted Solution

by:Chris_Gralike
Chris_Gralike earned 250 total points
ID: 18053014
Snort is indeed a verry good choice. Next to that, you can simply block port 0.

This is a common tactic in attempt to bypass the firewall wich "might" have a badly written rules in there. Most administrators dont realise there even "is" a port 0 and guess that port 1 is the first in the range.

Also on snort, you might need some basic linux knowledge and a switch / router / firewall that allows port forwarding..

-Regards,

0
 
LVL 10

Expert Comment

by:Chris_Gralike
ID: 18053019
or a old fashion Hub that is ;-)
0

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Along with being a a promotional video for my three-day Annielytics Dashboard Seminor, this Micro Tutorial is an intro to Google Analytics API data.
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

27 Experts available now in Live!

Get 1:1 Help Now