Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Thought about this seeing another question pop up about a user agent string showing up in the poster's logs; is there a site for sysadmins to go to for finding the latest information about signatures/tell tale signs of attacks currently running wild on the network? I know google-fu can help with stringing together evidence until I find things like "I'm seeing this on my network" or "this is in my log files..." but if a worm or malware attack is fairly new, searching typical virus databases from vendors may not be up to date (plus they can put a proprietary spin on things).

Is there a good central site for sysadmins to refer to when they see a sudden uptick in particular ports being probed or a particular string showing up in a scan or unusual activity in their internal network?

share|improve this question
up vote 2 down vote accepted

A couple of resources off the top of my head:

share|improve this answer

US-CERT is another (link points to the area for technical folk)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.