| T.R | Title | User | Personal
Name | Date | Lines |
|---|
| 265.1 | NETSERVER Never Lies | HITECH::DEMERS | Leo Demers | Tue Jun 24 1986 09:21 | 7 |
|
Yep, Just Look at your systems default DECNET account
and look at your NETSERVER.LOG's (You might need to
use BACKUP/IGNORE=INTER to get the ones currently opened)
Then just look for people running PHONE at the time of
the annoyance. - Leo Who found out who's was BOTHERing him.
|
| 265.2 | | GALLO::RASPUZZI | Michael Raspuzzi | Tue Jun 24 1986 11:04 | 6 |
| Can the same thing be done if the annoyer is on the same machine?
If it is a remote culprit, then .1 is right. The phone object number
I think is 27 (that may help when looking at the .LOG file).
Mike who has also caught net jokers.
|
| 265.3 | addendum de la errata | 11714::MCPHERSON | It's my life and it's my wife. | Tue Jun 24 1986 12:00 | 6 |
| re.2
I think the PHONE object is number is 29.
/doug
|
| 265.4 | Make sure NETSERVER.log isn't auto-purged 'tho | SUBSYS::LAWLER | N9910Q | Thu Jun 26 1986 08:21 | 13 |
|
Have the victim write down the exact time of the ocurrance
and search the decnet logs for short (under a minute) phone
connections which occurred at the same time. You may have
to modify the startnet comfile to not automatically purge
old netserver.logs. Incidently, we had the same sort of
thing happen here by somebody who was not completely fluent
in english. The grammar mistake in the bother message gave
him away instantly...
al
|
| 265.5 | ACCOUNTING does that too | TUNDRA::HARRIMAN | | Mon Jul 28 1986 10:29 | 11 |
| We had some of the same problems here in Burlington Vt... Even with
auto-purge of the DECNET accounts we have been able to catch probing
types using, of all things, the ACCOUNTING utility. Don't forget
that ACCOUNTING keeps info on all sorts of things, like who originated
a network link and such. We don't do image accounting, but the PHONE
utility leaves a definite characteristic trace (7 image activations,
always a network process, etc). And it can be used on a system when
normal interactive logins are disabled.... Any of you system types
can go at it if you like being a detective...
-pjh
|