Re: Is my network getting attacked?
- From: "Lanwench [MVP - Exchange]" <lanwench@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Sun, 10 Aug 2008 19:42:19 -0400
njem <njem@xxxxx> wrote:
Some strange behavior on the network at a non-profit so at a
suggestion I installed Wireshark to capture packets and I get strange
looking behavior. As a comparison I tried it on a couple of other
offices and don't get the same at all. Does this make sense to anyone
or can you point me to some hack-savvy forum where they might?
Below is about 30 lines of capture. On this Sat AM I have only the
server, a workstation, the router and the switch on. The other
stations have been off since the previous evening so all has had time
to get settled. The server, workstation, and router all keep sending
packets asking who has IP address x, and sending "name query" packets.
Then the switch keeps sending "Spanning tree" packets. I'm sure some
of this is normal on startup or periodic refresh but in this case it's
pretty much all the traffic over the course of this 14 second
snapshot.
Thanks,
Tom
<snip>
Is this network protected by a good-quality firewall appliance, or just a
simple NAT gateway/ consumer "router" ?
What's open/allowed inbound?
Any rogue computers connect on the LAN recently (e.g., visitor with laptop,
etc)?
microsoft.public.windows.security would be a good place to post (an updated
message)
.
- References:
- Is my network getting attacked?
- From: njem
- Is my network getting attacked?
- Prev by Date: Re: Network Neighborhood shows unknown name
- Next by Date: Re: Firewall telling lies Help
- Previous by thread: Re: Is my network getting attacked?
- Next by thread: Re: Can't connect to Internet
- Index(es):
Relevant Pages
|
