RE: Help - been tagged
- From: "Butte, Jeff M APX" <jeff.butte@xxxxxxxxxx>
- To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
- Date: Thu, 11 Oct 2001 12:58:00 -0500
Perform a WHOIS search on that ISP. Look at their record and see if they
have an abuse e-mail address or something to that effect. Most ISP's are
pretty good about it; even those in other countries.
Jeff Butte
HPD Server Team
Abbott Laboratories
mailto:Jeff.Butte@xxxxxxxxxx
-----Original Message-----
From: Carter, Elizabeth [mailto:ecarter@xxxxxxx]
Sent: Thursday, October 11, 2001 12:30 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Help - been tagged
http://www.ISAserver.org
So what does it mean if the first IP address in the entry is not a computer
on your network, but that of an ISP in another state?
*****************************************
Elizabeth C. Carter
Director of Information Technology
Virginia Episcopal School
400 VES Road
Lynchburg, VA 24503
434-385-3665 office
434-385-3667 fax
-----Original Message-----
From: Jay J. Mobley [mailto:jmobley@xxxxxxxxxx]
Sent: Thursday, October 11, 2001 1:21 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Help - been tagged
http://www.ISAserver.org
The best part about this log entry is:
, 401,
basicly it means that this web request was served with a 401 error.
Similar to a 404 error but different. 401 is unauthorized access i
think. if the return 200's its time to worry.
-----Original Message-----
From: stacy.barry [mailto:stacy.barry@xxxxxxxxxxxxxxxx]
Sent: Thursday, October 11, 2001 9:56 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Help - been tagged
http://www.ISAserver.org
Ok, I've been tagged. Which logs do I want to look in to find out by
who? I found this in the webdyyyymmdd.log log file: 200.11.179.84,
anonymous, -, -, 10/10/2001, 14:55:29, -, PORSCHE, -, www, -, 0, 0, 72,
3518, http, -, GET, http://www/scripts/root.exe?/c+dir, -, -, 401, -, -,
-
What exactly does it tell me? I'm not very experienced in reading these
logs. I've been trying to look back in the archives and on the
ISAserver.org site for additional info but haven't found anything. If
anyone can direct me in the right direction, I would much appreciate it.
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jmobley@xxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
ecarter@xxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
jeff.butte@xxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
