How do I find IP address of caller who tried to login & failed?

[F1lby]

Does anyone know of a way of viewing the IP address of callers who have tried to login via IIS using either BASIC or NTLM authentication and failed.

I have an extranet that regulary has numerous failed login attempts, but I'd like a way of tying these failed logins to an IP address so I can firewall accordingly....

Any ideas?

Rgds

Phil Blythe

 

[SWD]

The IP address is recorded in the IIS log

Roger Villeneuve

http://www.swd.ca

 

[F1lby]

Sorry, I wasn't specific enough...

I have a log with over 50000 entries each day and its painful going through the log

I suppose I could GREP it or something and output the results to a separate file, just wondered if there was a specific tool for the job to make life easier (for instance something in the Win2K resource kit...)