Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a newbie at Info Sec, and wanted to know which IP addresses are sources of attack traffic. Can I also find out which ports are being attacked?

Can this information be found in windows firewall? I have McAfee Virus Scan Enterprise 8.8, can I find this info there?

share|improve this question

closed as unclear what you're asking by tylerl, NULLZ, Gilles, TildalWave, Lucas Kauffman Jul 28 '13 at 12:31

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

you need give more info.please see – Shurmajee Apr 22 '13 at 7:37
How do you know you're being "attacked"? – Adi Apr 22 '13 at 10:19

Neither of those will help you on this one - Windows Firewall is not known to log anything of value unless you were already expecting something to happen, and McAfee is completely out of its depths in this case (hint: virus scan, not firewall).

Checking WF logs is done by going into it from the control panel and clicking Advanced settings on the left. From there, Monitoring -> Firewall. However, for it to have recorded anything, it will have had to go at least to your computer. There is at least one item in the way: whichever device handles your network's WAN interface, and as I assume you're on a home/small biz network, that would most likely be your router.

Find the admin panel of that and check its logs. It is bound to have some information on what has been going through. However, until you mention clearly what kind of attack you are being hit with, I can't be more specific than that. An attack may go from anywhere between a script kiddy simply flooding you to a targeted attack tailored on your choice of hardware to anything in between, and any open ports on the router adds to the possible list of suspects.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.