I have a disgruntle employer/colleagues and have been harassing me.
Basically, they are stuffing with the Internet connectivity. Previous incidents I have managed to pick due to their stupidity. I've seen shutdown commands, shutdown servers by the switch, cold booting servers and strange network activities like a single MAC address switching to multiple IPs (these IP's aren't within the DHCP range).
Now they've hired a new staff (meant to be a certified ethical hacker or something). They're really stuffing around with me now, here's whats been happening
* Denial of Internet access all computers - Basically, Internet traffic goes through a gateway server (the DMZ). What happens is computers on the network isn't able to access the Internet. I can ping the gateway but no external addresses. The gateway can ping externally.
* Denial of Internet access single user - Everyone in the network has access to the Internet except one user. I can ping the gateway, I can also ping the external DNS servers. However, the IP is not resolving for any of web address entered in the browser.
Please let me know how do I go about in investigating the matter. Cheers.
Please let me know how do I go about in investigating the matter. Cheers.
It sounds like a DNS mis-configured or however not resolving names.
I mean, if you open a browser and point it to
http//173.194.70.101/
do you get to google.com?
If yes it mean that there are not http connectivity issues, but simply a mis-configured DNS.
You can try setting the DNS to 8.8.8.8 or 8.8.4.4 (they are the public google DNS's).
But your report is a bit confused, I am not sure to have understood the actual issues, can you try to re-describe the issue(s), these are seemingly contrasting
I can ping the gateway but no external addresses.
I can ping the gateway, I can also ping the external DNS servers. However, the IP is not resolving for any of web address entered in the browser.
jaclaz
I've seen shutdown commands,
How so? Have you seen someone typing the shutdown command?
shutdown servers by the switch, cold booting servers
Ah, okay…then you don't need to really "investigate", do you? In order to see someone cold booting a server, you've have to be in the server room with them and see them do it, right?
and strange network activities like a single MAC address switching to multiple IPs (these IP's aren't within the DHCP range).
How did you see this? Was it a log of some kind?