We have someone that keeps trying to connect to our email host and after a few attempts of trying to log in (incorrectly) we are then blocked. We then have to call and unblock. Less then having everyone turn off there computer and devices, is there a way to find out who it is using nmap or wireshark? Thanks for any help.

  • 2
    Can you provide more information on your network diagram (without anything confidential ) and describe more precisely what kind of attempt block you from what service ? (stil keeping everything anonymous) – mveroone Aug 14 '13 at 13:41
  • Shouldn't the title be "Is it possible to find which computer in our office network is going to a specific website?" (Or something that's shorter.) – Arjan Aug 14 '13 at 13:46
  • @user245607 - Even if everyone never turned on their computers, attempts to get into the account would continue, this problem cannot be solved by the user it requires an network administrator. Your email host shouldn't even respond to clients outside of your network. Your network administrator also has access to the logs of those access attempts. Unless you are that admin what you want cannot be solved by you. – Ramhound Aug 14 '13 at 15:17
  • @Ramhound, as for "Your email host shouldn't even respond to clients outside of your network", why? The OP was not very clear which email host this applies to. But if employees want to read email away from the office, they need access to POP/IMAP. Also, assuming third parties want to send email to the company's domain, they need access to SMTP. (For years I've used Thunderbird with sendmail on my own machine, so my computer needed direct access to the recipient's SMTP server.) – Arjan Aug 14 '13 at 16:24
  • This question appears to be off-topic because it is belongs on serverfault – harrymc Jun 16 '14 at 15:28

Presumably you have a NATted network, so your errant user appears to your email host as the same address as all your users.

The solution depends very much on the topology of the network. The best bet is to find the switch that's connected to your external connection (but before the NAT takes place), configure a mirror port, connect a computer to that port with Wireshark, and log some traffic. Hopefully you'll be able to capture the traffic that's causing a problem.

| improve this answer | |

From Setting up a Honeypot:

A honeypot is a network, computer, or other system designed as a trap, to identify "bad people" and watch what they do, in order to learn about how they do it, so that defenses can be built against the attacks which are seen.

I recommend you to set up a honeypot server. If someone tries to use nmap-like software on your server, redirect him to the honeypot server.

| improve this answer | |
  • 1
    Your first paragraph was plagiarized from qmail.jms1.net/honeypot.shtml Please don't copy-paste from sources without attribution. This is not allowed. Always cite your sources and quote as little as possible. Use blockquote formatting for quotes (prepend the text with > or press Ctrl-Q). Thank you. – slhck Aug 14 '13 at 17:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.