Is this possible??

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Dear Pros,

I always get warning message from my DHCP server services and tell me that
the available IP is running low, I actually get this meesage from event log.
But after I check my DHCP leasing details I can always found at leat 8 to 10
un-identify PC, and the computer name which never exist in my company, with
the the identit information RAS? Is this meaning someone is connecting my
server from remote by RAS metho? If this answer is yes, how should I get the
connecting info? My company did not implement the VPN also we do not allow
user to connect to server after working hour (only normal mail services
available). So could this meaning someone is connecting to my server which
possible from the outsider?

We do have the problem with the previous IS employee, but he left our
company for a long time, the reason for me to said that is because he was
never stop to attact the company from time to time, by virus or mail bomb,
and always address himself as internal IS Dept. head. I caugh him few
times......................

So can please any one tell me how to invesgate this situation and how to
close possible the security leak hole.

Appreicate for the help in advance.

Snoopy
 
Could be normal for rras to use dhcp IP's for its vpn/l2tp
ports depending on configuration. Check Wins database
for the phantom name showing in dhcp, if found ping by
that IP for reply.
 
If your RRAS server is set up for remote access (RAS or VPN) it will lease
a batch of IP addresses (usually 10) from DHCP to use for that purpose.
 
Back
Top