Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to analyse my network traffic against intrusions or hackers. I looked at Snort but it seems difficult to install on Windows and overly complex anyway.

When I issue a netstat -a, I see various connections from unknown IP addresses, but I have no idea how to figure out what they are and if they pose any danger.

Is there any easy tool available for Windows?

share|improve this question
I've rolled back to your original version, since the new version was unusably vague. – CodesInChaos Sep 19 '12 at 10:29
up vote 3 down vote accepted

It can actually be quite difficult to do this, depending on the number of pieces of software that you've got installed and running on your system as a lot of legitimate software will make connections to the Internet without explicitly notifying you (everything from Dropbox to spotify to ...).

Also most websites these days use CDNs for content so will make connections to 3rd party domains while you're using them.

If you do want to do this I'd try using something like tcpview from Microsoft SysInternals. You could temporarily shut-down all the programs you know about and then look to see what connections are still in place and investigate each one. netstat -anb can also be useful as the -b switch provides some information on what program is making the request.

share|improve this answer

Netstat isn't the tool to use to find malicious traffic. The reasons are:

  1. It's done by machine. You'd have to be constantly checking every single system's netstat output to find anything. The more systems you have the harder it is to accomplish
  2. If your machine has been hacked you may not see all traffic. Some malware is able to prevent connections from being seen in netstat

For these reasons it's better to use traffic analysis from your network by using port mirroring as you'll see all the traffic. As for what tools to use to find malicious traffic you do need an IDS/IPS like snort.

The fact is it isn't easy to do, it's hard and it takes skill. But if it was easy they wouldn't need us.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.