Jump to content

Strange Routes


thelowlyone
 Share

Recommended Posts

Hi everyone,

I recently did a route print on a Windows 2003 Server running Windows Media Services. There are a lot of IPs in there that don't belong to me. And when I delete them "new" ones are added about an hour later all from the same IP range. What does this mean? Is someone trying to take my content?

Link to comment
Share on other sites

route print is a windows command line tool to show the current routing table and add/remove routes etc. like the route command in Linux.

seems weird that routes would be adding themselves. you say from the same subnet so its not the same routes each time? and when are they re-added? after a reboot? restarting a program?

Link to comment
Share on other sites

Thanks for the replies. The routes are added ~1 hour after I remove them. And yes they're not the same routes but are from the same IP range (ex. they all start with 66.xxx.xxx.xxx). I don't do anything and they just "appear" about an hour after I remove them. Is my server compromised?

Link to comment
Share on other sites

interesting. if there being re-added exactly an hour after you remove them i would suspect some program is doing it. check to see what processes are running etc and look for anything that does not look normal. also check event logs all tha usual stuff.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...