|
How to Track down Attackers -- and Get them Kicked off the
Internet
Let's say we decide the Internet will be a better
neighborhood if Mr. Cyber-Peeping Tom doesn't get to use the Internet for
awhile. Here's the first step.
With ZoneAlarm you can always click "More Info" on the alert
balloon. In many cases this will even provide a phone number, email and postal
addresses for an "Administrative Contact" for the computer that attacked you.
If this fails to tell you who the culprit is - as it did in
this case - you can still take action. To find out where to go to get
information on the owner, you can trace the route between the attacking computer
and yours.
Figure 7: Hacker hunting with a trace route.
In the MS-DOS (or, in Windows XP, the Command Prompt) window, give the
command:
C:\WINDOWS\tracert 204.999.57.252 (substitute the numerical
address of your attacker for 204.999.57.252)
You should see something like Figure 7.
In Linux or Mac OS X, open a terminal window and give the
command:
~>traceroute 211.999.59.41
You will see something like this:
traceroute to 211.999.59.41 (211.999.59.41), 30 hops max, 40
byte packets
1 Parkland-7206.fubar.com (216.999.248.1) 1.248 ms 1.445 ms 1.31 ms
2 Parkland- fubar.com (101.999.40.1) 2.038 ms 1.937 ms 1.895 ms
3 s0-1-4-swanpop-swancore.fubar.net (206.999.8.73) 2.688 ms 3.054 ms 3.276 ms
4 206.999.8.89 (206.999.8.89) 7.59 ms 8.345 ms 7.584 ms
5 aads.px.ca.fubar.net (206.999.243.59) 8.093 ms 8.396 ms 8.374 ms
6 a1-0-0d7.core2.scl-ca.us.fubar.org (207.999.0.189) 58.597 ms 58.637 ms 58.728
ms
7 ge9-0.tran1.scl-ca.us.fubar.org (64.999.0.49) 57.708 ms 57.721 ms 58.092 ms
8 p0-0.tran1.pal-ca.us.fubar.org (64.999.0.2) 59.012 ms 58.847 ms 58.753 ms
9 ge0-0.dist1.pal-ca.us.fubar.org (64.999.0.19) 59.326 ms 59.108 ms 59.828 ms
10 ge2-0.access1.pal-ca.us.fubar.org (64.999.2.20) 59.204 ms 58.879 ms 59.39 ms
11 207.999.240.110 (207.999.240.110) 59.197 ms 59.858 ms 59.205 ms
12 210.999.97.173 (210.999.97.173) 180.612 ms 182.669 ms
13 211.999.39.18 (211.999.39.18) 186.046 ms 180.525 ms 180.652 ms
14 211.999.0.222 (211.999.0.222) 180.594 ms 180.738 ms 182.452 ms
15 211.999.50.142 (211.999.50.142) 186.617 ms 182.788 ms 186.709 ms
16 211.999.57.245 (211.999.57.245) 185.559 ms 187.593 ms 188.973 ms
17 211.999.49.51 (211.999.49.51) 185.599 ms 187.543 ms 188.073 ms
| 
