Firewall activity

Yahoo Archive
1
There is a great web site for finding what host an IP address belongs to. It
also includes contact information on that host. The web site is
http://www.dslreports.com/whois type the address into the box and you will
find out who is hosting the address. Then you can contact the host and can
ask them why it is happening. Hope it helps.

David Rueckert
-----Original Message-----
From: gilsonscreen@... [mailto:gilsonscreen@...]
Sent: Tuesday, December 10, 2002 4:44 AM
To: vantage
Subject: [Vantage] firewall activity


Hello group

I am looking for some info on firewall activity. Our firewall software is
blocking numerous attempts of entry into our system each day. Is there some
way that I can find out who the culprits are? It is disturbing that some
days there are as many as one hundred plus entries in the log.

Thank you

Mel Warniment
Gilson Screen Incorporated


[Non-text portions of this message have been removed]


Useful links for the Yahoo!Groups Vantage Board are: ( Note: You must
have already linked your email address to a yahoo id to enable access. )
(1) To access the Files Section of our Yahoo!Group for Report Builder and
Crystal Reports and other 'goodies', please goto:
http://groups.yahoo.com/group/vantage/files/.
(2) To search through old msg's goto:
http://groups.yahoo.com/group/vantage/messages
(3) To view links to Vendors that provide Vantage services goto:
http://groups.yahoo.com/group/vantage/links

Your use of Yahoo! Groups is subject to the Yahoo! Terms of Service.


[Non-text portions of this message have been removed]
2
Hello group

I am looking for some info on firewall activity. Our firewall software is blocking numerous attempts of entry into our system each day. Is there some way that I can find out who the culprits are? It is disturbing that some days there are as many as one hundred plus entries in the log.

Thank you

Mel Warniment
Gilson Screen Incorporated


[Non-text portions of this message have been removed]
3
At 07:44 AM 12/10/2002 -0500, you wrote:
>I am looking for some info on firewall activity. Our firewall software is
>blocking numerous attempts of entry into our system each day. Is there
>some way that I can find out who the culprits are?

This is a pretty good article:
http://www.robertgraham.com/pubs/firewall-seen.html

A lot of what you're seeing is probably relatively harmless scans being
done by novice hacker wanna-bes (aka "script kiddies") or machines that
have been compromised already. I still get a bunch of Nimda infected
MS-IIS probing us.

I signed up with SpamCop.net to keep our email clean, and discovered
another nice benefit: you can plug any IP address into their reporting
system and it does an excellent job of tracking down who it belongs
to. Bunch easier than manual methods. Check it out.

-Wayne Cox
Twenty Three - Information Technology Consulting
828-685-2338