Re: Reporting hacking

["Jim Franz" <franz400@xxxxxxxxxxxx>]

> Is there a channel to report hacking?
>
if it is a random attack, block the ip address at the router or firewall,
and step up monitoring.
Watch your other network devices, router, firewall, NT's etc.
They may be your weakest link (say it ain't so!) then it may be easy to
plant
a sniffer on an NT and wait for your 400 traffic to float by.
If you are being persistently targeted by the same address, contact the FBI.
I think they are interested in certain foreign groups.
FBI is in most phone books.
jim franz


> My boss is enamored with Op's Nav performance monitoring.  He happened to
> notice that the FTP jobs on our web server 400 were eating up some CPU
> percentage.  Not much, but some.  We were getting ready to do a ftp site
> but not prime time yet.  We fired up our Pentasafe reports and determined
> that a certain IP address was trying to probe us for ftp.  Pentasafe was
> slamming the door on them.  We decided to try to access that ip address
> from one of our browsers and got a Romanian pharmaceutical company.
> (Although I am not too good on my Cyrillic alphabet).
>
> Since our ftp is not prime time yet, we changed our firewall to block all
> external ftp for now.  Basically as a defense in depth, and to take a load
> off of the 400.  We thought about just blocking this IP address:
> 212.93.151.182
>
> Rob Berendt
>
> ==================
> A smart person learns from their mistakes,
> but a wise person learns from OTHER peoples mistakes.
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
>