Re: [Emerald] Help finding Spammer...

Josh Hillman ( (no email) )
Mon, 13 Dec 1999 11:52:41 -0500

Here's a script (similar I guess to the one that's now built into Emerald)
that I use for this sort of thing:

/* Username associated with IP address at specific point in time */

/* If a STOP record (AcctStatusType=2) was not entered into the */
/* database by radius, this script will not work. */

SET NOCOUNT ON
DECLARE @datetime char(20)
DECLARE @IPAddress char(15)

SELECT @datetime = '10/6/99 5:23am'
SELECT @IPAddress = '123.123.123.123'

SELECT Username=convert(char(16), Username),
"Start Of Session" = convert(char(20), DateAdd(Second, 0 -
AcctSessionTime - AcctDelayTime, CallDate)),
"End Of Session" = convert(char(20), DateAdd(Second, 0 -
AcctDelayTime, CallDate)),
"Seconds" = AcctSessionTime,
"IP Address" = FramedAddress,
CallerID
FROM Calls
WHERE DateAdd(Second, 0 - AcctSessionTime - AcctDelayTime, CallDate) <=
@datetime
AND DateAdd(Second, 0 - AcctDelayTime, CallDate) >= @datetime
AND FramedAddress = @IPAddress
AND AcctStatusType = 2

----- Original Message -----
From: David Routh <drouth@davlin.net>
To: <emerald@iea-software.com>
Sent: Monday, December 13, 1999 8:19 AM
Subject: [Emerald] Help finding Spammer...

> Hello,
>
> Is there a way to pull information like which customer was logged on at
> what time and using what IP?
>
> The reason I ask is we evidently had someone spamming from our site over
> the weekend using bogus info on the headers... our IPs were associated
with
> MindSprings servers... now, I'm not real good at deciphering headers but
> looks like I may have to learn.
>
> Anyway, I've got PLENTY of headers that were sent back to us over the
> weekend so I can determine the time and have the IPs associated from the
> headers...
>
> If there's no way to do this how would I go about setting up so we can
tell
> when a customer was logged on and on what IP...
>
> Thanks for your help.
> David
>
> For more information about this list (including removal) go to:
> http://www.iea-software.com/support/maillists/liststart
>

For more information about this list (including removal) go to:
http://www.iea-software.com/support/maillists/liststart