I had someone submit a rather alarming notification in the ticket system anonymously. How can I at least trace from what subnet the message was submitted from? I've checked IIS logs and nothing useful there.

That's a lot harder to do then you might think.If a ticket is sent via the web then the ticket system weill report the IP address that was used, but if you or they are using NAT then it will be the public IP address.example: if my subnet is 192.168.0.1-250, and I have a real world IP of 10.10.10.10 on the router that is handling my NAT anyone on the 192.168.0.1-250 would appear to the outside as 10.10.10.10.If it was send via email however you might be in luck.  You can view the ticket and on the first thread click the down arrow on the upper right of the first message.  And select View Headers.  Of course you would need to know how to read email headers, but they aren't super hard.You could prevent anonymous tickets, by requiring registering for an account. (but then there is the chance that people would just create accounts with fake creds).

no luck but thanks anyways

Write a Reply...