Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Netstat has been one of my favorite tools to check out possible malicious connections, but then I heard about the dangers of rootkits and their high complexity, allowing them to be able to bypass anti-virus software and even many anti-rootkit detectors.

Today I noticed my Internet connection was slow. Even though I am connected with DSL, cable, and 3G, it was slow on all three when I tested, and so I decided to check out my network on my way.

The only tool the that spot a suspicious activity from my network was my router, a cheap one, DIR-300. I tried to gather information from four possible sources as shown in this screenshot http://i.imgur.com/9MyOXgY.png .

  1. First page: Gateway session activity page.

  2. Second page: IP address reverse lookup results: Verizon??? I don't think I'm using any of their services, and to make ir worse, on PORT 11106, aka SGI LK Licensing service.

  3. Third page: Nothing found on Wireshark for that port.

  4. Fourth page: NMAP with Backtrack running on VMware.

Am I taking the wrong route to find out what is causing this traffic?

What is the most effective way to check out malicious connection activity on my network?

Is it possible to know how much packets are received and sent from a certain tcp connection on my router?

share|improve this question

1 Answer 1

What is the most effective way to check out malicious connection activity on my network?

Wireshark is really the best way to inspect the packets your after. If there were a root kit that was hiding from wireshark (possible but highly unlikely) then you could set up wireshare another machine and man-in-the-middle the suspect machine with arp poisoning between the supect machine and your gateway.

Is it possible to know how much packets are received and sent from a certain tcp connection on my router?

Not from your router, check out the user manual You can use ntop to see that infromation.

share|improve this answer
1  
Alternatively, if you can flash your router with DD-WRT (or similar), you can SSH in and monitor your network with tcpdump. –  Tom Marthenal Jan 21 '13 at 5:01
    
Would like to state that Tomato works great as an or similar with the above. –  deed02392 Oct 23 '13 at 13:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.