Posted by serge on 06/21/05 13:40

> Well.. I found their hostname (server) through profiler.. And i see
> they are trying to login to 'sa' account.. but i wouldn't think
> trying to login (every 5seconds or so) would result in me getting
> packets from that IP every .02 seconds...

> What can I do after this? I guess i could block their ip via my cisco
> PIX firwall.. but is there anyway to automatically block a user that
> tries to login to 'sa'? From what I have read, SQL doesn't have a
> feature to block users based on their ip

Why do you have your SQL Server open to the Internet in the
first place? The application being used is what? If you have an
IIS Server hosting the application then you could simply have
your SQL Server port 1423 blocked.

[Back to original message]