From: Lane Powers <lpowers@mis.net>
To: Payal Rathod <payal-iptables@staticky.com>
Cc: netfilter@lists.netfilter.org
Subject: Re: finding out the culprit ip
Date: Thu, 04 Sep 2003 15:49:01 -0400 [thread overview]
Message-ID: <3F57972D.7060709@mis.net> (raw)
In-Reply-To: <006b01c37317$c1cfd0d0$0a90a8c0@zen>
Well, any easy quick way to identify the culprit, would simply be to use
tcpdump...
according to
http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html
sobig will attempt to get ntp at least once per hour
so something simple like;
tcpdump -n -i eth1 udp port 123 (assuming that eth1 is your internal
interface and you aren't currently legitimately making outbound ntp
requests on all your workstations :) )
or you could use netfilter to block the traffic and then check your logs
Lane
www.rstack.net
>>Hi,
>>A particular machine in my LAN is affected by SoBig virus and is sending
>>mails to remote sites. I need to find that IP. The only lead I have is
>>that it is that IP which is generating maximum SMTP traffic. How do I
>>find it out and block it (or maybe clean it)?
>>
>>Any ideas on this?
>>With warm regards,
>>-Payal
>>
>>
>>
>
>
>
>
>
>
next prev parent reply other threads:[~2003-09-04 19:49 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-09-05 18:34 finding out the culprit ip Payal Rathod
2003-09-04 19:07 ` Mike Tubby
2003-09-04 15:49 ` Jason
2003-09-04 19:49 ` Lane Powers [this message]
2003-09-04 21:13 ` Tom Marshall
2003-09-05 11:47 ` Dharmendra.T
2003-09-05 11:57 ` Dharmendra.T
2003-09-05 13:21 ` Mark Vevers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3F57972D.7060709@mis.net \
--to=lpowers@mis.net \
--cc=netfilter@lists.netfilter.org \
--cc=payal-iptables@staticky.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.