Topic: IP that triggered dialup

[Jaco Bongers]

Hi

I am still trying to track the machines that start a dialup. I have used ipstat (as recommended previously ) which has been a great help. The problem is that some of the triggers (cat /var/log/messages | grep Trigger) are at random times.

The log file does not show the source of the IP request. Is there a way to log which IP (PC on the network) requested an outside link?

Thanks

Jaco

[Jim Bradley]

How many machines are on your network? IF it only a few, I'd look at the time of the Trigger, then look at the cron files of the network machines to see if something is set to start at that time.

Another thing to check is to see if any of the network machines was installed with sendmail. I had a machine that kept triggering my dialout, and sendmail was the culprit.

[Jaco Bongers]

Jim

Thanks for the reply

We run a network with about 10 windoze PC's. Most of the dialups are
triggered by DNS lookups. The log shows that the DNS lookup occurs at random
times. The problem is that the log does not indicate which machine did the
DNS lookup.

If there is a way to log the originating IP address that requested the DNS
lookup, then I can easily pinpoint the problem.

I have found the following problem:
Programs like Gator, MP3 players, etc check for updated software. I had to
ask the users to remove the software (in the case of Gator) or to disable
the auto-check-for-updates functionality of their software.

It can become an administrator's nightmare to keep finding these software
packages that the users install on their system. An entry in the log will
make it trivial to sort out.

Jaco

[guestFF]

Hi all,

I found that if the DNS is set on the win machines, a print-job sometimes triggers a DNS request (pending on connection type of the printer)

Just a well intended remark.

Thx

HFW