Rootkits, how much should I be concerned? I found a suspicious activity on my network

Question

In the old age netstat was one of my favorite tools to check out possible malicious connection, but then I took note about the dangerous of incoming rootkits and its high complexity, being able to bypass all famous av's and many anti-rootkit detectors. I was going to ask this question some months ago but I didn't want to be vague and lazy for not googling enough, and coming in here as last resort only. However today I noticed my internet was slow enough even connected with DSL, cable and 3G, it was slow on these three when I tested, and decided to check out my network on my way.

The only tool the that spot a suspicious activity from my network was my router, a cheap one, DIR-300. I tried to gather information from four possible sources as shown in this screenshot http://i.imgur.com/9MyOXgY.png .

1. First print: Gateway page.

2. Second print: Checking out. Verizon??? I don't think at all I'm using its service, and to make ir worse, on PORT 11106, aka SGI LK Licensing service.

3. Third print: Nothing found on Wireshark.

4. Fourth: NMAP with Backtrack running on VMware.

Am I taking the wrong route or the the right route to find out what I want?

1. I would like the print itself to make the main question.
2. What is the most effective way to check out malicious connection activity on my network?
3. Is it possible to know how much packets are received and sent from a certain tcp connection on my router?
4. I care if this question may not be useful for many of yours but as I said that's my last resort, taking this question to serious specialists on IT security. Thanks in advance.

Answer 1

What is the most effective way to check out malicious connection activity on my network?

Wireshark is really the best way to inspect the packets your after. If there were a root kit that was hiding from wireshark (possible but highly unlikely) then you could set up wireshare another machine and man-in-the-middle the suspect machine with arp poisoning between the supect machine and your gateway.

Is it possible to know how much packets are received and sent from a certain tcp connection on my router?

Not from your router, check out the user manual You can use ntop to see that infromation.