geting IP number from security logs
Results 1 to 4 of 4

Thread: geting IP number from security logs

  1. #1
    Junior Member
    Join Date
    Apr 2002
    Posts
    2

    geting IP number from security logs

    Howdy!
    I have IIS 5 and when i log in i get a message that says something like "could not log in Administrator" and then says some more stuff....

    the times are like every hour or every half hour or so. only two people have access to this box so i belive it is someone try to hack it.

    is the IP number being saved when this happens? all i see is the time that they tried to get in.

    thanks

  2. #2
    Senior Member
    Join Date
    Jul 2001
    Posts
    196
    Check your winnt/system32/logfiles folder
    You'll find the log files numbered by date there. Dates,IP, etc are recorded here.

  3. #3
    Junior Member
    Join Date
    Apr 2002
    Posts
    2
    ok, this is strange.

    i have a win2k box that i have admin rights to. i can ftp in or term serv in. when i term serv in i get some event logs that say [user] couldn't be logged in PASSWORD incorrect.

    at first i thought these were from someone trying to ftp in. there were alot of them.
    but when i check the logs all the IP address's are mine.

    now i am the only one using my machine, plus, the times are while i'm on my machine.

    what is going on?

    if you need more info please ask.

  4. #4
    Senior Member
    Join Date
    Jul 2001
    Posts
    196
    Originally posted here by pnj
    ok, this is strange.

    i have a win2k box that i have admin rights to. i can ftp in or term serv in. when i term serv in i get some event logs that say [user] couldn't be logged in PASSWORD incorrect.

    at first i thought these were from someone trying to ftp in. there were alot of them.
    but when i check the logs all the IP address's are mine.

    now i am the only one using my machine, plus, the times are while i'm on my machine.

    what is going on?

    if you need more info please ask.
    Probably because the server doesn't allow anon connections, so perhaps at first when connecting it tries to be anon then moves on to username/password to log you in. I get this sometimes on mine if I log into ftp and don't realize that I'm anon and not a user, have to log out and back in with username/password then because I have seperate areas setup for public and private ftp.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •