In the old age netstat was one of my favorite tools to check out possible malicious connection, but then I took note about the dangerous of incoming rootkits and its high complexity, being able to bypass all famous av's and many anti-rootkit detectors. I was going to ask this question some months ago but I didn't want to be vague and lazy for not googling enough, and coming in here as last resort only. However today I noticed my internet was slow enough even connected with DSL, cable and 3G, it was slow on these three when I tested, and decided to check out my network on my way.
The only tool the that spot a suspicious activity from my network was my router, a cheap one, DIR-300. I tried to gather information from four possible sources as shown in this screenshot http://i.imgur.com/9MyOXgY.png .
First print: Gateway page.
Second print: Checking out. Verizon??? I don't think at all I'm using its service, and to make ir worse, on PORT 11106, aka SGI LK Licensing service.
Third print: Nothing found on Wireshark.
Fourth: NMAP with Backtrack running on VMware.
Am I taking the wrong route or the the right route to find out what I want?
- I would like the print itself to make the main question.
- What is the most effective way to check out malicious connection activity on my network?
- Is it possible to know how much packets are received and sent from a certain tcp connection on my router?
- I care if this question may not be useful for many of yours but as I said that's my last resort, taking this question to serious specialists on IT security. Thanks in advance.