• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

SYN, DenialofService Attacks

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2000 General] >> General >> SYN, DenialofService Attacks Page: [1]
Login
Message << Older Topic   Newer Topic >>
SYN, DenialofService Attacks - 29.Oct.2001 6:44:00 PM   
jenifern

 

Posts: 26
Joined: 5.Jul.2001
From: Houston, TX USA
Status: offline
Help, I am being attacked. My ISP has helped me track some of the IP's but some seem to be spoofed. I need to create a log hourly instead of daily. The logs are so large I cannot load them in anything to view. (currently I have a large log loaded in an Access table.)Currently I am disabling logging, renaming the file and enabling logging again. The file is Gigabytes if I let it go for an entire day.

I realize this is not an ISA problem but I would like to know of any way to manage or block it after a particular IP hits my router so many times.

some of the logs indicated that the attacking server was trying to run cmd.exe. My ISP determined this to be the CodeRed virus infected servers.

Now the logs show information I cannot read, like a dump from debug.

Enough rambling, can anyone point me in a direction here?

Can I stop this?

Post #: 1
RE: SYN, DenialofService Attacks - 29.Oct.2001 9:25:00 PM   
tshinder

 

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Jenifer,

A couple things you can do:

1. Turn off logging. This isn't a very good idea.

2. Log fewer fields. You can change the fields that are logged in the properties dialog box of the logs.

You should also stop all the ISA Server services and remove the logs as it sounds like they may have become corrupt. After moving the logs, restart the ISA services.

HTH,
Tom

------------------
http://www.isaserver.org/shinder/


Get It Here!


(in reply to jenifern)
Post #: 2

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2000 General] >> General >> SYN, DenialofService Attacks Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts