Tracking down hacks (pre script.log) Arma 2

[XmarksTheScot 1]

Hi there ladies and gents as you may doubt realize from the thread title im trying to gain some info on how to actually find out who hacked the server when looking over logs.

Currently we run an Arma 2 server which ofc being 1.11 doesn't support the lovely new BE script.txt feature (get your finger out BI). So how then do i find out who hacked the server and what files should i be looking in.

I currently have BEC running logging console and chat, and also have the server logfile specified in the config too.

Any help would be appreciated as currently we just have to restart and hope that next time we can spot him and ban but with very little way of seeing who hacks the server even if your on at the time its hard goin.

[XmarksTheScot 1]

Nearly 50 views and no1 even replies with a "sorry cant help"

PFFT!!!!!!!

[eddieck 10]

1.11 shouldn't have the packet encoding OA 1.62 has, so you should be able to use a packet sniffer (tcpdump/Wireshark) to look for hacks.

Is this Windows or Linux?

[XmarksTheScot 1]

Its a Windows server mate

Are these programs i run onthe server then?

[eddieck 10]

Its a Windows server mate

Are these programs i run onthe server then?

Yes. Take a look at these two tools:

http://www.winpcap.org/windump/ - packet sniffer

http://ngrep.sourceforge.net/download.html - grep for pcaps (allows you to find certain text based on what is happening in the server)