Need to Identify which infected Desktop is copying files to a Linux NFS share?

kumarullal · 05-18-2011, 12:19 PM

Hi,
I have iomega appliance, which is based on Debian distribution. There is an NFS share that I have created which is without password.
Since it is without password, there are some viruses copied. I want to find out which IP address is the source of these files. In other words, I want to know which PC is copying these infected files on the NFS share.
Is there a way to find out?
Thanks in advance.

rayfward · 05-18-2011, 03:10 PM

Hi.
I'm assume you are using windows 7.
From a command prompt type arp -a
This gives you a list of all ip's connected to your machine. Wire shark can monitor connections or you could just trawl through the event logs.

kumarullal · 05-18-2011, 04:40 PM

I am using Debian 5.0 The NFS share called "Backups" is on Debian without password or credentials. So anyone can get access to the NFS share "Backups".
Therefore the infected PC is copying files to that share the moment I delete them from that share.
I want to find out the IP address of the infected PC which is causing this.

rayfward · 05-19-2011, 02:31 PM

Ok
arp -n will catch any active connection to your server. You could use netstat which will produce bucket loads of data on networking however you can trim this down. Use man netstat to get the list of switches and options.

Good luck.