Our network is possibly being attacked? Need help

[Thorn]

Originally Posted by McKindling

I ran wireshark during the problem and noticed that everytime I tried facebook.com there was a TCP retransmission that wireshark detected. Does this sound malicious?

No, it sounds like a transmission error specific to Facebook, or Facebook's DNS.

Originally Posted by McKindling

Also, I learned that a year ago our ISP informed us that someone had physically connected to our line. Our ISP thought they were stealing our internet and thought they removed them, but gave no other details. I wasn't managing our IT at the time.

Could there be a physical man in the middle attack occurring?

Yes.

[McKindling]

Hey all,

I was doing my best to analyze the packets I captured and I eventually stumbled onto ICMP redirect attacks.

Does this sound like our situation? How can I catch these people if it is?

Also, after the facebook competition (causes dot com) ended we have only had facebook redirect once in 5 days now. During the competition it happened 20+ times a day.

[compaq]

@OP
What range is the workstations IP's in.
What is the DNS on the workstations set to.
Do you have a server(apart from a computer just storeing files with file and print sharing),include AD
What are the routers between you and the internet, do they have manual assiged DNS., forwarding or ,(that thing that gets the page somewere else if not local)
Are anything used for proxying(not including workstation).
Do you have your own web page, internal extenal, any rediercts in that.

[McKindling]

Hey Compaq,

• The IP ranges of the workstations are 101-150 (192.168.0.101...150)
• DNS for the workstations are 192.168.0.1. IP's are manually assigned. Subnet is 255.255.255.0 and default gateway is 192.168.0.1
• No server
• Our setup is: Modem>Router (WRT310N2 with V12 firmware)>Switch(all computers hooked up to the switch except for 1 on the router)
• No proxying is used
• We do have our own webpage which is hosted on a server that we pay for. No redirects on that.

Thanks for your help.