Identify source IP for Security Log Failure Audits (ISA?)

I am getting lots of failed logon attempts from a particular OUTSIDE workstation. I want to identify the port & source IP.

I am running ISA with the usual SMTP, POP, DNS, TS, FTP and a few other ports open - I use all of them for one purpose or another.

Is ISA the place to look to identify the source IP and port?

Brian
Thu Jun 17 13:38:01 CDT 2004

Just a followup: I turned on logging of allowed packets and manually went through the packet log. However, I am have been unable to correlate the times of the allowed packet events in the ISA log with the times of the logon failures. I have been getting the logon attempts from workstation "OEMCOMPUTER" now for a couple of days, using common words, but I cannot see any IP address in the ISA log that has been showing up consistently throughout that time.

Maybe I need some help with setting up my ISA log, or is it possible that this is some sort of automated attack coming from multiple IP addresses so that each one shows up only for a short time?

"Brian" wrote:

> I am getting lots of failed logon attempts from a particular OUTSIDE workstation. I want to identify the port & source IP.
>
> I am running ISA with the usual SMTP, POP, DNS, TS, FTP and a few other ports open - I use all of them for one purpose or another.
>
> Is ISA the place to look to identify the source IP and port?