On 15 Mar 2002, at 9:32, Dencer Brenda wrote:

> I downloaded and installed Zone Alarm (free program).  Since
> installing, I get messages telling me that a certain IP address has
> been trying to get into my computer (I have cable internet).  The
> first time I got the message was around 7:30pm.  When I got up this
> morning, I was welcomed to the 84th try by this same IP address.
> How can I track it down?

  If he's only trying one or two ways in, and Zone Alarm is blocking
those, then eventually he'll get bored and go away.  Odds are that
he's just looking for any machine his few borrowed tricks will work
on.(*)

  If he's trying a whole bunch of different things, though, then it's
more likely that he's deliberately targetting you or your machine for
some reason.  This is the sort of thing that warrants being taken
more seriously.
  Depending on exactly what he's doing, the "source address" may
actually be that of the attacker, or of a machine that he has already
successfully broken into.  A complaint to the ISP that connects this
machine to the Internet might get some result, especially if it's in
the U.S. and especially if they understand that he is specifically
targetting YOU.

  You can often determine what ISP is responsible for a certain
address range by searching the "whois" database at www.arin.org.
(The result you get there may refer you to APNIC if this address is
in the Far East, or RIPE if it's in Europe.)
  You can also sometimes get a machine name out of DNS by using the
nslookup command and feeding it the IP address.  If this is a dial-
up, it may at least tell you who the ISP that runs the POP is, and
you can use www.abuse.com to find out an email address for complaints
against their domain.

(*) Since you've recently installed Zone Alarm, it's possible that
this guy has been abusing your machine for some time, and is trying
to figure out why he suddenly can't get BACK in.  Heck, maybe that
"Client Foundation" is something *he* installed.  A fresh install of
the OS might be a sensible precaution, in case he has left you other
"goodies"....

Dave Gillett

               The NOSPIN Group Promotions is now offering
              Mandrake Linux or Red Hat Linux CD sets along
         with our NOSPIN Power Linux CD...  at a great price!!!
             http://freepctech.com/goodies/promotions.shtml