主页 / computer / 问题 / 1735175
Accepted
blablaalb
Asked: 2022-08-04 09:20:59 +0800 CST

托管在 Windows 10 上的 MongoDB 数据库被盗。我可以找出连接的计算机的IP地址吗？

  • 772

在此处输入图像描述 这是我从睡眠中唤醒计算机后遇到的消息

我可以找出连接并窃取数据库的计算机的 IP 地址吗？Windows 10 是否维护最近连接的日志？

更新：我检查了路由器日志，这个 IP 地址在日志中重复了几次：82.211.191.129。我将我的 IP 地址替换为$MY_IP_ADDRESS.

  5days, 10:22:28, DHCPC: Recv OFFER from server 82.211.191.129 with ip $MY_IP_ADDRESS.
  5days, 10:22:28, DHCPC: Send REQUEST to server 82.211.191.129 with request ip $MY_IP_ADDRESS.
  1days, 07:37:18, DHCPC: eth1 set ip $MY_IP_ADDRESS mask 255.255.255.192 gateway 82.211.191.129.

有人可以简要解释一下这些日志的含义吗？我不知道我在看什么。

更新#2：在mongod.log文件内部，我发现这个 193.118.53.138 ip 地址已连接到数据库。我用谷歌搜索，这个 ip 似乎被列入黑名单

{"t":{"$date":"2022-08-03T14:53:57.446+04:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"193.118.53.138:60277","uuid":"14888a3e-9ed6-4ac8-81a9-c6a72302691e","connectionId":15,"connectionCount":14}}
{"t":{"$date":"2022-08-03T14:53:57.518+04:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn15","msg":"Connection ended","attr":{"remote":"193.118.53.138:60277","uuid":"14888a3e-9ed6-4ac8-81a9-c6a72302691e","connectionId":15,"connectionCount":13}}
{"t":{"$date":"2022-08-03T14:53:57.591+04:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"193.118.53.138:60606","uuid":"c1a8d3d3-a248-4d00-9910-76eeef200fdc","connectionId":16,"connectionCount":14}}
{"t":{"$date":"2022-08-03T14:53:57.663+04:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn16","msg":"Connection ended","attr":{"remote":"193.118.53.138:60606","uuid":"c1a8d3d3-a248-4d00-9910-76eeef200fdc","connectionId":16,"connectionCount":13}}
{"t":{"$date":"2022-08-03T14:53:57.736+04:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"193.118.53.138:60880","uuid":"8da8d4dd-a66e-4d4c-8937-4c8c429b6d4b","connectionId":17,"connectionCount":14}}
{"t":{"$date":"2022-08-03T14:53:57.970+04:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn17","msg":"Connection ended","attr":{"remote":"193.118.53.138:60880","uuid":"8da8d4dd-a66e-4d4c-8937-4c8c429b6d4b","connectionId":17,"connectionCount":13}}
{"t":{"$date":"2022-08-03T14:53:58.042+04:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"193.118.53.138:33364","uuid":"37e844b4-1437-4f71-80ea-26426301af32","connectionId":18,"connectionCount":14}}
{"t":{"$date":"2022-08-03T14:53:58.112+04:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn18","msg":"Connection ended","attr":{"remote":"193.118.53.138:33364","uuid":"37e844b4-1437-4f71-80ea-26426301af32","connectionId":18,"connectionCount":13}}

167.248.133.63 也已连接。也有报道。

{"t":{"$date":"2022-08-03T14:05:54.033+04:00"},"s":"I",  "c":"NETWORK",  "id":22943,   "ctx":"listener","msg":"Connection accepted","attr":{"remote":"167.248.133.63:33704","uuid":"2a078c1d-c476-45ad-bfdb-4e4d8b4f353a","connectionId":14,"connectionCount":14}}
{"t":{"$date":"2022-08-03T14:05:54.356+04:00"},"s":"I",  "c":"NETWORK",  "id":22944,   "ctx":"conn14","msg":"Connection ended","attr":{"remote":"167.248.133.63:33704","uuid":"2a078c1d-c476-45ad-bfdb-4e4d8b4f353a","connectionId":14,"connectionCount":13}}
networking

1 个回答

  1. Best Answer

    MongoDBmongod.log以 json 格式存储它。检查它是否有NETWORK事件，其中包括网络活动，例如接受连接。

    您的路由器DHCPC日志在这里可能一文不值，忽略它们

    请注意，可以不受限制地访问 MongoDB 的人可以做任何服务可以做的事情，包括破坏或窃取您机器上其他文件的数据。不要在互联网上打开它。

    • 1

相关问题