Beside knowing "how should you define when you're under attack", here are the first tools that can help you ...

If you notice an IP address trying to do really bad things, you can :

trace him (tracert or traceroute), which will show you one way that connect your system to his. This can help you determine if it is possible that the attack come from here.

Also, whois is a greatly appreciated tools, which can give you lots of informations about the provider leading this range and so on. INteresting when you want to report hack attempts to the provider.

Jean-Francois