🔒 Locked

Connection tracing

Started by Witchcraven May 7, 2003 at 12:57 AM 4 replies 300+ views

Original Post

May 7, 2003 at 12:57 AM

My server has been the target of many attempted hacks recently, and I am kinda tired of it. I also want to learn more about tcp/ip, so I thought a good project would be to write a connection tracer. Basically I want to scare the crap out of the hackers that keep on trying to get in. I want my program to start tracing when it detects a spoofed packet. I know several techniques to do that, mostly inspection the TTL field. But I am not sure how to trace a connection(especially through multiple "bounces"). I have some vague theory on how to do it, but I am not sure. If the hacker didnt spoof their MAC address, I could probably find them through ARP, but I am not well versed on low level protocol well. Oh yeah, is it legal to trace a hacker connection on your server? Any ideas on tracing would be appriciated.

Raduprv

May 7, 2003 at 1:03 AM

Forget the MAC idea, over Internet.
And why do you think people try to hack your server?

Height Map Editor | Eternal Lands | Fast User Directory

Witchcraven

May 7, 2003 at 1:08 AM

Who knows. THere isnt anything important on it to them. Its a test bed for my mud. Its a rather advanced mud, but I have not released any details about it yet. So I dont know how they would know. I think it is because hackers are annoying. Well these are probaby bad hackers, cause if they were good I probably wouldnt know. But they know enough to not use their comp directly. I hate them soo much. I wish they would leave me alone. *sob*

Sneftel

May 7, 2003 at 1:10 AM

I think he means, what makes you think they''re trying to hack you?

How appropriate. You fight like a cow.

Witchcraven

May 7, 2003 at 1:20 AM

Hmm, syn floods, I caught someone actually on before I blocked sendmail. A rougue perl script. Odd messages being echoed to my terminal device. Too many listings on who.. Way too many log entries I put up more security that stopped them from getting in, but they are still trying. Its eating bandwidth. Plus if I have a hole in my test mud that could be bad. I will eventually need to run more server apps, so I need to stop it. I want to find the kiddies and report them to their isp. I dont think there are too many hackers. Probably a group of irritating kids in their parents basement. Writing this thing, or trying would be a good learning project too.

Witchcraven

May 7, 2003 at 1:22 AM

If I can make a decent tracer, I am gonna change my hostname to gibson.tk

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.