 |
||
 |
 |
 |
 |
 |
| A Scandal in Cubefarm Bohemia! by laudablepuss 02/18/2005, 5:09pm PST | ||||
 |
 |
|||
| Sometimes, I hate being a network admin. I really don't want to know about the personal lives of the idiots and perverts who make up my user base. Today I got a glimpse into the personal life of one of them, and I'm writing this so I can forget. Wait. I guess I'm going to try forgetting about it after I post.
Today, a user got an error from Windows saying that he had a duplicate IP. He kept getting kicked off the network, even after rebooting. I took a look but couldn't figure out why Windows thought the IP was already in use . . . DHCP informed me that only that machine had the IP and when I released it from his machine, I couldn't ping it from mine. No network appliance or printer or anything else had been given that address by mistake. What the heck? Windows helpfully records the MAC address of the device with the duplicate IP. So we started tracking it down. We have a packet sniffer (I can't provide many details since I didn't set it up) and we used it to find the thing and examine its traffic. We still had no idea where the physcal device was. It moved around, getting different IPs over the course of a few hours. Kinda strange. Well, we see that this thing is being used to connect to a certain mail domain as a certain username that happened to coincide with a username on our network. So my coworker and I went up to have a talk with the user, to politely inquire if they knew anything about this. I'm not terribly imposing physically but my coworker is pretty big guy, maybe somewhat intimidating. I explained that we were looking for a computer on our network that was acting strangely, that we'd seen this machine log into the aforenotmentioned email service with what appeared to be his name. Well, this guy looked scared. He has his own office, he was sitting and we were standing, and he looked like he wanted to defenestrate ASAP. When I asked if I could look at his machine, he asked in return if I could come back in 20 minutes. Okay, sure. 20 minutes later we go back up. He's not there. We take a look at his machine, but there's nothing interesting there. But, as we suspected, there was a second laptop sitting off to one side and somewhat hidden from view from a person in the doorway. Clearly not one of ours. I fired it up to take a look. The guy comes back at that point, and I inform him that his machine seems fine, but I was curious about his other laptop. Oh, that's mine. No kidding? Can I check the MAC address on it? I never hook it up to the network. He takes a seat and we talk for a bit, us explaining why we're worried, giving him some crap about thinking he might have a Trojan or something. Out of the blue he tells us his Dad died and that's why he's "stressed out". Stressed out isn't the same thing as nervous, and he's got a cold sweat going. Okay, whatever, we leave without looking at his laptop. I'm already feeling bad about making this guy miserable. We get back and the third guy in my department has news. He's been sifting through the previously captured traffic and he's got packets showing the mystery machine connecting to an escort service, and an email from a girl confirming an appointment with Nervous Guy. I never wanted to know about this stuff. How dumb can this guy be? Using his laptop from work, using his own real name for these transactions . . . Hopefully he's been terrified into not connecting that thing to our network anymore, but if we see it's on there again, I'm going to open it up and determine once and for all whether it's got the MAC address we're looking for. And then, maybe trouble. I don't even want to contemplate it. :( |
||||
 |
 |
|||
|
