Discussion Locked

Intruder Detected

0 helpful
6 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I computer at a lab where I work was having some problems and it was suspected a hacker was playing with it. We installed Attacker v3.0 from Foundstone, and it picked up an IP Address of someone accessing ports on the computer.

We do not know what to do with the IP Address now. Is there some directory we can use to look up whose IP address that is? What do we do with this IP address of someone who seems to be accessing our computer in some way or another.

How can we stop this?

6 replies

by timwalsh

There are several organizations and utilities that you may need to search to actually track down who this IP address is registered to:

Utilities:

Ping: at DOS prompt, type "ping IP address /a"; The result should give you the computer name (and most importantly the domain name)

Traceroute: at the DOS prompt, type "tracert IP address"; you may get the same results in addition to clues as to what part of the world the IP address resides in

Organizations:

www.arin.net - registry for North and South America, the Caribbean, and Sub-Sahara Africa
www.apnic.net - registry for the Asia Pacific region
www.ripe.net - registry for Europe, Middle East, North Africa, and parts of Asia

If you search a registry for an IP address that is not covered by that registry, you will normally be told which registry does cover it.

Sometimes all you will be told is that a given IP address has been assigned to a given ISP. Other times you will be told exactly which business or even person has registered a given IP address.

You may be directed to search smaller national registries (particularly in the area covered by APNIC). Some of these are:
www.aunic.net - Australia
www.krnic.net - Korea
www.jpnic.net - Japan

Most registries provide procedures for reporting abuse (such as hacking or Spam). If you happen to be located in the same geographic region as where the IP address is hosted, you may have other legal recourses available to you depending on local laws.

Hope this helps.

by b_pope

One other thing you may want to check before going to far, are you running a Windows based operating system all of which do try to access the Internet & cause high alerts when using port monitoring software, these show as outgoing attempts. As well your ISP does the same & they usually are incoming attempts.

Might be a good idea to check with your Internet provider first, could save you a lot of time.

This discussion is closed to new replies.