Re: OT: IP Address & Frewall

[<steve@xxxxxxx>]

The attacker is most likely a "script kiddie" who is just doing a scan over your whole range of IP addresses.

It is possible to find out the isp of the attacker, and then if you have the muscle get them to tell you who had that ip, at the specrifc time they attack you.

They'll probably tell you to sling your hook though ;)

 

 

from what i have found it is probably a non subscription isp, have a look at this:

http://members.tripod.com/backlash105/newsgroup_lockouts.txt

 

search for the mask of your attackers ip addy:

 

(press ctrl+f in IE)

 

213.1.166.*

 

you'll see this guy has blocked the ip range from his newsgroup servers, becuase he gets lots of spam from the range, whcih suspects it would also be a likely hangout ofr 13 yr old script kiddies.

 

 

HTH Seeya

 

steve

----- Original Message -----

From: Kenneth Watt

To: ukha_d@xxxxxxx

Sent: Friday, December 07, 2001 4:01 PM

Subject: [ukha_d] OT: IP Address & Frewall

Guys,

 

I only ask this in here because I know that somebody will know the answer and be able to explain what I should do about it.

 

My PC has been being snooped by some crafty little bugger but Norton Personal Firewall stopped the intrusion and has given me the IP address of the local address and the remote address. Now, more for my own curiosity rather than being nasty (…would I *best angelic look*) I would like to find out who it is but I don’t know how I would do this and I would like to learn how to resolve this and find this stuff out, plus this clown has now tried this two nights on the trot.

 

Really I just want to learn more about the way the net works with IP addresses and suchlike, like I said, I’m curious.

 

The log I got is this:

 

Date: 07/12/2001 Time: 21:21:13

Rule "Default Block Hack 'A' Tack Trojan horse" blocked (213.121.70.35,31789).  Details:

Inbound UDP packet

Local address,service is (213.121.70.35,31789)

Remote address,service is (213.1.166.88,31790)

Process name is "N/A"

 

Any pointers any of you can give would be great.

 

BTW, thank you all for the nice comments about the new arrival, much appreciated, so much so even Tracey says thanks and she thinks I spend far too much time reading e-mail! ;-)

 

K.

For more information: http://www.automatedhome.co.uk
Post message: ukha_d@xxxxxxx
Subscribe:  ukha_d-subscribe@xxxxxxx
Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
List owner:  ukha_d-owner@xxxxxxx

Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.

Yahoo! Groups Sponsor

ADVERTISEMENT

For more information: http://www.automatedhome.co.uk
Post message: ukha_d@xxxxxxx
Subscribe:  ukha_d-subscribe@xxxxxxx
Unsubscribe:  ukha_d-unsubscribe@xxxxxxx
List owner:  ukha_d-owner@xxxxxxx

Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.