My home network has been shutoff by my Internet Provider twice now because it is "trying to gain access to unauthorized resources" within the Internet provider's network.
I am trying to track down the offending device so I can purge any malware that has taken root on it, but I am not sure how.
I have a number of computers running, Linux, macOS, and Windows and some (not many thankfully) IOT devices, any of the above could be the culprit, and only a few of the devices (macOS and Windows boxes specifically) have anti-virus software that I know of.
My network topology is pretty simple, I have a Modem/Router connected to the internet provided to me by my Internet Provider (made by Arris) that is also connected to another wireless router (I think both act as DHCP servers with the wireless router sitting on its own subnet, routing traffic to the Modem as needed, but I will need to confirm how I set it up after I get home).
All of my devices connect to either of these two devices and get internet traffic forwarded on to my Internet Provider.
The only way I can think of tracking this down is asking my Internet Provider for details on the resource my network is allegedly trying to access and then setting up Wireshark and putting my NIC in promiscuous mode and waiting for it to happen again.
Is there a better way to track this Malware down?