Messenger advertisements are annoying
After reading the newbie guidelines and tutorials I’m a bit paranoid to ask my first question.
Well here goes: -
It’s about spamming programs that use the net send command: -
Is it possible to find out the ip address from the sender or am I missing something obvious?
I know you can disable the messenger service to stop these but that’s not the point. I can’t seem to find any info about tracing the ip from the source. On the message it only displays the ‘so called’ host name and message. I am trying to find out the ip of the source. I believe there are programs out there that manage mass messaging, that are supposed to give out a bogus pc id and ip. Although there are quite a few arguments in the forums about anonymity on the internet most that I have read say tracing is always possible.
There seem so many different network monitoring tools out there. Can someone recommend a good one for me to start with?
Thanks in advance.
I had something similar happen to my school...
shot_gun_stu: Logging port 139 is the only way I know. But there is just one problem with doing so... If you are on a LAN (like school), there is a LOT of legitimate traffic on port 139...along with all of the other ports, normal broadcast messages, etc...
Just recently, my school was "bombed" with these messages. The person who did so had the nerve to use part of the name of one of the web-servers on the LAN to throw everyone off. After that, I had Ethereal setup, but at first it was logging ALL incomming data. I had 100+ packets a second - obviously not something that would make it easy to search through a week later when it might happen again. I was later able to get it to log port 139 data, but I still had to deal with about a packet a minute. The computer was on for several days, and no other messages were tracked. However, I had about 5,000+ packets that were to port 139. Luckily, filtering came in handy to only show the net-send messages (there were none).
You might think that using Ethereal to find these and get the IP are handy, but there is on major problem on a LAN like schools, etc... It eats up a LOT of power, and eventually HDD space if not configured properly. I typically had 10-20% CPU power used by Ethereal on my webserver (whose partial name was used) and it was a P4 1.6GHz system, but with 128MB RAM... Even with all of that..., I have NOT found out who sent the message because I wasn't prepared for it before-hand... And there haven't been many messages after that, so I stopped using my time to search for them.
I hope that helps sheds some insight...
-Tim_axe