Find out ip address of local client that is using incorrect authentication for imap

[markomilutinovic]

Hi, first time posting here. I always do a deep research before asking questions but this issue seems like a no find.

Is there a way to find out which client in local network is using incorrect authentication when accessing the server? Lets assume 5 devices in total, mobile phones, tablets, laptops, are using the same email address behind the same wan address.

I only have this information.

May 13 00:05:29 cp dovecot: imap-login: Disconnected (auth failed, 3 attempts in 17 secs): user=<[email protected]******.rs>, method=PLAIN, rip=178.148.239.***, lip=178.**.204.**, TLS, session=<iKtdqHqlMLCylO/B>

Is it possible to capture packets, wireshark, or some other method to find this local ip (client device) using session or I'm lost and going in wrong direction?

I have a feeling there is an easier way to find this out and maybe I'm overthinking. Apart from going on site and checking all their devices.

Thank you in advance,
Marko

 

[cPanelLauren]

You could use Wireshark thsark or tcpdump - I know you can show mac addresses all of them which I believe would be useful for what you're trying to do.

 

[ffeingol]

Or just ask them to visit one of a few hundred sites that gives them their IP address in the browser? We have one setup for our clients, but I don't want to spam the forum with the link.

 

[markomilutinovic]

Thank you guys! I will try with few options and will inform with easiest solution.