How do I record the outbound 'attack' traffic from a botnet on a Windows XP machine? The captured traffic will be in the Windows XP firewall log.

I need to setup some kind of an experiment where I can use a Win XP firewall log for later analysis, for research purpose.

2 Answers 2


If you want to use the XP firewall log, just enable it - it works tolerably well.

Better may be to use wireshark, which will log the actual data sent out from the machine

  • Thanks for your reply! I think a real life experiment could work. Setting up a vulnerable XP machine for a fixed amount of time, with logging enabled etc. Though there must be other ways
    – Nocker
    Mar 24, 2011 at 14:01
  • 1
    @nocker - depending on what you want to do, look on the honeynet.org web pages. They have stacks of data on botnet comms etc
    – Rory Alsop
    Mar 24, 2011 at 14:08

This posting on Getting Started with Basic Malware Analysis was almost built to answer to this question.

The author of the blog post explains using Remnux with fake DNS, fake services, etc as the gateway to a malware infected Windows XP machine. He also mentions putting a Dionaea instance on the network as well, to see if the infected host attacks it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .