Easy way to analyse my netstats for intrusions?

Question

I want to analyse my network traffic against intrusions or hackers. I looked at Snort but it seems difficult to install on Windows and overly complex anyway.

When I issue a netstat -a, I see various connections from unknown IP addresses, but I have no idea how to figure out what they are and if they pose any danger.

Is there any easy tool available for Windows?

Answer 1

It can actually be quite difficult to do this, depending on the number of pieces of software that you've got installed and running on your system as a lot of legitimate software will make connections to the Internet without explicitly notifying you (everything from Dropbox to spotify to ...).

Also most websites these days use CDNs for content so will make connections to 3rd party domains while you're using them.

If you do want to do this I'd try using something like tcpview from Microsoft SysInternals. You could temporarily shut-down all the programs you know about and then look to see what connections are still in place and investigate each one. netstat -anb can also be useful as the -b switch provides some information on what program is making the request.

Answer 2

Netstat isn't the tool to use to find malicious traffic. The reasons are:

1. It's done by machine. You'd have to be constantly checking every single system's netstat output to find anything. The more systems you have the harder it is to accomplish
2. If your machine has been hacked you may not see all traffic. Some malware is able to prevent connections from being seen in netstat

For these reasons it's better to use traffic analysis from your network by using port mirroring as you'll see all the traffic. As for what tools to use to find malicious traffic you do need an IDS/IPS like snort.

The fact is it isn't easy to do, it's hard and it takes skill. But if it was easy they wouldn't need us.