Track down Stick DOS tool with ISS IDS

I have some bozo running the Stick DOS tool on my network @ work trying to stuff the IDS so it falls over. Luckly we are using ISS and it will not allow Stick tool DOS traffic to stuff it's DB to the point it dies...

My problem is that the bozo is spoofing his IP address to 0.0.0.0 and I'm not good enough @ IDS/Security/Etc yet to track him down.

Any ideas on how to track him down?

Thanks!

Tfunk

Setup a TRONS signature to detect it yourself.

/nebulus


EDIT: I am assuming you are using the latest available versions of Site Protector/ISS sensors (which if you are, you are not vulnerable to it anyway). If you are not, you will either have to attempt to build your own using the ISS default connection stuff (very limited IMHO), or attempt to capture it using tcpdump with alot of flags on your own sensors.

nebulus

You are correct...ISS Network Sensor when patched is not vunerable. My actual concern is that someone is being mischevious on the network (running stick) and I would like to track them down.

Thanks for the reccomendation for trons. I am going to dig into it and see what I can come up with. I know ISS will use trons, but I haven't messed with them yet. I'm going to dig into it and see what I can come up with.

If you need a quick primer I could probably help you.

/nebulus