Snort.org home  
Got Source? About Snort About Sourcefire Snort FAQ
Sourcefire Network Security - the creators of Snort
Snort News Downloads Snort Docs Rules Snort Community Snort Forums Snort Training
Search Site
Search Rules
Account
email
password
not registered?
user preferences

Snort Forums Archive

Archive Home » General Security Discussion » How to find the source IP of an attack?..I am in trouble :(

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

How to find the source IP of an attack?..I am in trouble :(


Posted by besmile4ever on December 31, 2007 10:32:31

HI..
Dear all my server is very slow and the CPU is almost 99%..from time to time..we think that it is an attack..because I am new to security how can I find the source IP of the attack? my server is freebsd?
is there a tool or way that will help to find the source IP,,and also it will help to decide is it a flooded traffic or attack.


fast response will be highly appreciated.

Cheers.

Posted by snort_dude on March 17, 2008 07:32:40

Suggest setting up a Snort Box and go from there.
site feedback | Terms of Use | Privacy Policy | forum archives ©2008 Snort and Sourcefire are registered trademarks of Sourcefire, Inc. All rights reserved.