ftp hacker

I have this guy who is trying to hack into my ftp server i see several Microsoft ftp services failed authentication attempts by administrator and i know its not me lol. Does anyone know of any network monitoring softare available that can record those connection attempts and provide me an IP address ?

Most FTP servers usually have a built-in logging option. Check the documentation for your particular server or post its name here. If you're definitely sure that your FTP server does not have a logging option, you could rely on your firewall logs (i.e. if you have one)

Check out Snort here:

www.snort.org/

Pretty sure the MS FTP logs all connections to a log file within the c:\windows\system32\logfiles. Within here you should see logging for the FTP Service (may need to turn on additional logging options to get useful stuff from it though).

Once you have identified the IP Address info, you can then block it on the FTP server aswell as your external firewall.

Cheers

yeah i had to set the ip option in order to get the ip addresses

I quite agree with Smurf about the log files .Also you can couple that by enabling auditing in the security analysis and configuration tool in mmc.

Also, you can use the "netstat -n" to check ip addresses running at your background .If are conversant with port numbers, you can figure out strange port numbers and block them.