Home | Community | Message Board
You are not signed in.
Sign In New Account
Forum Index Search Posts Trusted Vendors Highlights Galleries FAQ User List Chat Store Random Growery

Sporeworks
This site includes paid links. Please support our sponsors.

General Interest > Science and Technology
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Welcome to the Shroomery Message Board! You are experiencing a small sample of what the site has to offer. Please login or register to post messages and view our exclusive members-only content. You'll gain access to additional forums, file attachments, board customizations, encrypted private messages, and much more!

Jump to first unread post Pages: 1
Network Monitor on Win2K Pro - Any TCP/IP Buffs out there?
    #1910707 -

I'm running an IIS based web server on win2K Pro, and have recently been getting some really odd hack attempts (HTTP propfind and options headers) that are coming from ip addresses that look like they're internal to my network (192.168.0.x) but which don't actually exist. I wanted to install network monitor at examine the packets and try and work out what's going on, but it seems it's only available in W2k server (Thanks microshaft.. very useful).

Do any of you know of any free software that does basically the same thing, or have any suggestions on how I can get to the bottom of this? I'm assuming it's one person whose IP I can ban on my firewall if I can find out what it is, but without network monitor I dunno how I can do that as the server only logs the internal address. It's odd I've never come across anything like this before.

Extras: Filter Print Post Top
Re: Network Monitor on Win2K Pro - Any TCP/IP Buffs out there? [Re: Phyl]
    #1910827 -

some MS engineer posted this somewhere else

"
WinPcap is a public domain set of utilities for this, although I haven't
used them personally. It looks like you need to use a tool on top of
WinPcap, either 'Analyzer' or 'WinDump'. The first is a UI, the second is a
command line app. Do a search for for all three (WinPcap, Analyzer, and
WinDump) and I believe you'll find what you need.
"

Maybe that will help u? I've never messed with it, I just use netmon (buahaha)

Extras: Filter Print Post Top
Re: Network Monitor on Win2K Pro - Any TCP/IP Buffs out there? [Re: djfrog]
    #1911953 -

Doesn't sound like a hack attempt to me since its coming from a private address.
Donwload Network probe or some other free protocol analyzer if you wish to dig deeper.




--------------------
--------------------
We're the lowest of the low, the scum of the fucking earth!

Extras: Filter Print Post Top
Re: Network Monitor on Win2K Pro - Any TCP/IP Buffs out there? [Re: Scarfmeister]
    #1912173 -

Cheers for the pointers to the software.

If it's not a hack attempt, have you got any idea what's going on? Check out the log below. 192.168.0.10 doesn't exist on my network. I've got 4 computers, 2 have static addresses (X.2 and X.3) and 2 use dhcp with a range from X.15 to X.200. Like I said I've never seen anything like this before, it's really odd.

[09-08-2003 - 00:03:31] ---------------- Initializing UrlScan.log ----------------
[09-08-2003 - 00:03:31] -- Filter initialization time: [08-18-2003 - 20:49:11] --
[09-08-2003 - 00:03:31] Client at 172.189.95.215: URL contains extension '.ida', which is disallowed. Request will be rejected. Site Instance='1', Raw URL='/default.ida'
[09-08-2003 - 17:19:05] Client at 192.168.0.10: Sent verb 'OPTIONS', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:14] Client at 192.168.0.10: Sent verb 'PROPFIND', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:14] Client at 192.168.0.10: Sent verb 'PROPFIND', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:20] Client at 192.168.0.10: Sent verb 'PROPFIND', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:23] Client at 192.168.0.10: Sent verb 'OPTIONS', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:29] Client at 192.168.0.10: Sent verb 'PROPFIND', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:29] Client at 192.168.0.10: Sent verb 'OPTIONS', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:32] Client at 192.168.0.10: Sent verb 'PROPFIND', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:38] Client at 192.168.0.10: Sent verb 'PROPFIND', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:38] Client at 192.168.0.10: Sent verb 'OPTIONS', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:38] Client at 192.168.0.10: Sent verb 'PROPFIND', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:41] Client at 192.168.0.10: Sent verb 'PROPFIND', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:47] Client at 192.168.0.10: Sent verb 'PROPFIND', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:50] Client at 192.168.0.10: Sent verb 'PROPFIND', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:19:53] Client at 192.168.0.10: Sent verb 'PROPFIND', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:20:16] Client at 192.168.0.10: Sent verb 'OPTIONS', which is not specifically allowed. Request will be rejected.
[09-08-2003 - 17:26:26] Client at 192.168.0.10: Sent verb 'OPTIONS', which is not specifically allowed. Request will be rejected.

Extras: Filter Print Post Top
Re: Network Monitor on Win2K Pro - Any TCP/IP Buffs out there? [Re: Phyl]
    #1912435 -

I did a google search on 'default.ida', it suggests the Code Red virus is looking for vulnerable IIS servers.

Extras: Filter Print Post Top
Re: Network Monitor on Win2K Pro - Any TCP/IP Buffs out there? [Re: djfrog]
    #1917711 -

It would help if you could get the MAC address and see if it matches to any of the active interfaces from your networked clients. Run 'ipconfig /all' from cmd on each of your windows clients and ensure that none of the interfaces are at 192.168.0.10. I have seen windows XP do some very odd things with networking and addresses when the network bridge is enabled.

You might also try unplugging your network from the WAN and see if the requests continue. That at least will tell you if they are from inside or outside your LAN. The 192.168.0.0 class B is not supposed to route, but I have seen misconfigured routers that allow traffic to pass through on that network.

The code-red thing was (probing for .ida) was from an outside address of 172.189.95.215 and seems unrelated to the following traffic from 192.168.0.10.

Of course, your real problem is that you are running Micro$oft products in the first place. Your best solution would be to switch to a real OS such as Solaris, or even Linux, and a real web server such as Zeus, or even Apache.


--------------------
Just another spore in the wind.

Extras: Filter Print Post Top
Jump to top Pages: 1

General Interest > Science and Technology
Threaded Mode Threaded  Previous topic Previous  View all topics Index  Next topic Next 

Similar ThreadsPosterViewsRepliesLast post
* IPX over TCP/IP? OJK 1,129 4 09/13/06 07:43 PM
by Therapy
* Fucking port forwarding torrent client oink protocol tcp ip ucp ejahg grrrrrrr Irradiated_Feces 3,501 11 12/04/05 01:01 PM
by i_eat_planets
* wirless router/network problems
( 1 2 all )		 demiu5 2,391 24 08/01/07 04:07 PM
by delta9
* IP Address Question
( 1 2 all )		 Madtowntripper 3,367 20 02/12/08 05:26 PM
by justin340
* your ip address in a network Xeluc 913 6 11/21/07 04:21 AM
by Seuss
* ip question John 550 1 11/26/04 11:00 AM
by andjor
* ip adress randomizer nihilistism 6,290 15 09/08/07 10:18 PM
by OJK
* I have IP addresses of people that send me viruses .... What to do with them. JettaJay 1,500 11 12/21/04 12:35 AM
by JettaJay

Extra information
You cannot start new topics / You cannot reply to topics
HTML is disabled / BBCode is enabled
Moderator: trendal, automan, Northerner
1,285 topic views. 0 members, 20 guests and 3 web crawlers are browsing this forum.
[ Show Images Only | Sort by Score | Print Topic ]
Search this thread:

Copyright 1997-2026 Mind Media. Some rights reserved.

Generated in 0.025 seconds spending 0.008 seconds on 16 queries.