查看單個文章
舊 2007-06-16, 03:29 AM   #4 (permalink)
plunderer
長老會員
 
plunderer 的頭像
榮譽勳章
UID - 74024
在線等級: 級別:51 | 在線時長:2853小時 | 升級還需:59小時級別:51 | 在線時長:2853小時 | 升級還需:59小時級別:51 | 在線時長:2853小時 | 升級還需:59小時級別:51 | 在線時長:2853小時 | 升級還需:59小時級別:51 | 在線時長:2853小時 | 升級還需:59小時級別:51 | 在線時長:2853小時 | 升級還需:59小時
註冊日期: 2003-05-31
文章: 1399
精華: 0
現金: 507220 金幣
資產: 608580 金幣
預設


網管至少得具備一點英文基礎吧....

We have a residential (ie: I don't control what is on them) network here of up to 500 computers at any one time. Currently there is a machine doing an ARP-cache poisoning attack against the network. For some unknown reason, it is inserting the string "1^LIBraBBGvB8i~o+Z~UU?L5{B~SLIB5C" into HTTP responses just after the HTTP headers. I presume (NOTE: this is speculation, I have not yet been able to examine the machine in question) that this is due to a trojan/worm or other malware on the system performing the attack, possibly trying to spread itself to other computers on the subnet accessing the web running a vulnerable web browser - although I have not yet identified the effect of that string, so it may be for some other purpose.
I suggest you check other machines on your network for possible compromises.
Use a program like wireshark to examine network traffic to see if there are a continuous stream of ARP responses that _appear_ to be from your router to every other IP address in the subnet, but telling them in incorrect MAC - the computer with that MAC will be the culprit - you may use nmap to find the IP address of the machine. Alternatively if you are using a managed switch, you can look for the MAC that maps to just about every IP address on the subnet.

這是 MSDN 論壇的回覆, 看看有沒有幫助
__________________
刑天舞干戚
plunderer 目前離線  
送花文章: 6, 收花文章: 575 篇, 收花: 1747 次
回覆時引用此帖
向 plunderer 送花的會員:
foxlee (2007-06-16)
感謝您發表一篇好文章