Have I experienced a Windows security breach? |
 |
EXPERT RESPONSE FROM: Kevin Beaver
|
|
|
|
| > |
QUESTION POSED ON: 30 January 2008
Why are so many strange IP addresses in our route print table? Does this indicate a Windows security breach? We have two domain controllers, and the primary domain controller shows the highest number of strange IP addresses. We also have a firewall installed on our network environment.
|
|
| > |
|
This could be related to DNS resolution being done on the server (which it likely is). Have you tried to browse or otherwise connect to some of the addresses you're seeing? There's also a chance that some type of malware is on the machine creating these entries. Have you tried flushing your route table? Try doing that (after-hours to minimize problems of course) to see if/when the entries come back. Beyond that, the best way to troubleshoot this is to install/run a good network analyzer (such as OmniPeek or Sniffer Pro) on the server – or a monitor/span/mirror port on your switch – and see who's talking to what. It's always pretty shocking just how much is happening on the network that you'd otherwise never know about.
|
|
|
|
|
|
|
|
Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and
answer pairs from more than 250 TechTarget industry experts.
|
|
|
|
|
|
|
|
|
|
|
|
