Intrusion detected: What is to do??

[joeka77]

If ISA notifies me about Intrusions with the suspicious IP, what should i do? Block the IP (But i can block only special Ports with Packet filter)?? Is it possible to get more Information (i.e. what port, details) about the intrusion?? Can somebody give me some tips?

Greetings J.

 

[SgtB]

Your log files should tell you the source IP, destination IP, source port, and destination port of the 'attack'.

I'm pretty sure you can block inbound access for all ports for that one IP address.
Create a group called 'known_hackers' or something like that, and just peoples' IP's in this group as they pop up.


Cool upcoming game! Check it out!

http://www.planetside-universe.com

!