Denial of Service attacks etc.

[Guest]

It appears that our small Win2K network [3 servers] is being 'hit' from the outside (our T1 Cisco and hub lights are flashing on/off continually until the primary domain controller is shut down for the night or weekend. Then the flashing stops. We have just performed an anti-virus scan using two anti-virus software. Nothing was found). All servers are Win2K SP4 with all security fixes applied to Win2K and all database applications. [We have a Windows VPN configured but it's not open very much for very long. Typically, once a week for about 2-5 minutes each.]
How can we A) protect ourselves from this and/or further intrusion
B) How can we stop this external attack(s) from occurring? (Redirection etc.).
C) How can determine from where the 'attack(s)' are coming from?
TIA,
Tom

 

[Lanwench [MVP - Exchange]]

It appears that our small Win2K network [3 servers] is being 'hit'
from the outside (our T1 Cisco and hub lights are flashing on/off
continually until the primary domain controller is shut down for the
night or weekend. Then the flashing stops. We have just performed an
anti-virus scan using two anti-virus software. Nothing was found).
All servers are Win2K SP4 with all security fixes applied to Win2K
and all database applications. [We have a Windows VPN configured but
it's not open very much for very long. Typically, once a week for
about 2-5 minutes each.]

What makes you think it's coming from the outside?

How can we A) protect ourselves from this
and/or further intrusion

Do you have a good perimeter firewall in place? If not, get one ASAP. This
is mandatory. Block all unneeded ports, both inbound and outbound. I
personally like Sonicwalls - PIX is nice too.

B) How can we stop this external attack(s)
from occurring? (Redirection etc.).

Don't know what you mean by redirection, but the first step is to have a
firewall in place. Then harden your servers' security. Enable auditing. Etc.

C) How can determine from where
the 'attack(s)' are coming from?

You will be able to see this in your firewall logs.