Is suspicious network activity likely to be caused by a rootkit?

Question

Netstat has been one of my favorite tools to check out possible malicious connections, but then I heard about the dangers of rootkits and their high complexity, allowing them to be able to bypass anti-virus software and even many anti-rootkit detectors.

Today I noticed my Internet connection was slow. Even though I am connected with DSL, cable, and 3G, it was slow on all three when I tested, and so I decided to check out my network on my way.

The only tool the that spot a suspicious activity from my network was my router, a cheap one, DIR-300. I tried to gather information from four possible sources as shown in this screenshot http://i.imgur.com/9MyOXgY.png .

1. First page: Gateway session activity page.

2. Second page: IP address reverse lookup results: Verizon??? I don't think I'm using any of their services, and to make ir worse, on PORT 11106, aka SGI LK Licensing service.

3. Third page: Nothing found on Wireshark for that port.

4. Fourth page: NMAP with Backtrack running on VMware.

Am I taking the wrong route to find out what is causing this traffic?

What is the most effective way to check out malicious connection activity on my network?

Is it possible to know how much packets are received and sent from a certain tcp connection on my router?

Answer 1

What is the most effective way to check out malicious connection activity on my network?

Wireshark is really the best way to inspect the packets your after. If there were a root kit that was hiding from wireshark (possible but highly unlikely) then you could set up wireshare another machine and man-in-the-middle the suspect machine with arp poisoning between the supect machine and your gateway.

Is it possible to know how much packets are received and sent from a certain tcp connection on my router?

Not from your router, check out the user manual You can use ntop to see that infromation.