Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So last night I was using openVPN via my personal cloud server to watch some Hulu.

About 15 minutes into the movie I noticed my network stats were

download: ~250 MB upload: ~1.8 GB

This is according the the openVPN software.

I paused my movie and the download stopped but my upload jumped from 1.8 to 1.9 and stopped at 2.1 in less than 5 minutes.

I only start my VPN to watch movies and my stats reset everytime I disconnect.

I wasn't torrenting and no other software was running that uses network traffic (to my knowledge).

This strikes me as highly suspicious. I ran anti-virus and anti-spyware scans on my system and found nothing.

How can I use wireshark to tell if I'm being hacked?

share|improve this question

closed as not constructive by Adi, Antony Vennard, TildalWave, Iszi, NULLZ May 28 '13 at 22:05

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

I don't want to sound like a jerk, but have you gone through Wireshark documentation? There's some nice videos even, user guide, you name it. Your question is really not specific enough and this Q&A format here isn't all that suitable for writing complete how-to guides. Please refer to FAQ, How to Ask and About pages here for more information. Thanks! – TildalWave May 28 '13 at 18:51
You could simply have fired up wireshark. The protocol, source and destination columns can give a good indication, what's going on. Then, if you don't know how to interpret results, ask again. – copy May 28 '13 at 18:59

To clarify, in your situation, you likely have already been hacked, and malicious software is sending traffic. Wireshark can help to confirm this and to characterize the type of infection.

Turn off as many services as you can, close all browsers, then confirm that the upload is occurring. Turn on Wireshark to monitor the traffic.

Wireshark might be able to identify it right away, but it does still require some interpretation of the data it displays. Perhaps most importantly, find out the destination of all the major traffic and use a whois lookup to see who it is that you are communicating with.

In the end, you will have to be prepared to scrub your machine, or blow it away and start from scratch.

share|improve this answer
Unless it's a browser plug-in leak. – AbsoluteƵERØ May 28 '13 at 20:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.