Netstat has been one of my favorite tools to check out possible malicious connections, but then I heard about the dangers of rootkits and their high complexity, allowing them to be able to bypass anti-virus software and even many anti-rootkit detectors.
Today I noticed my Internet connection was slow. Even though I am connected with DSL, cable, and 3G, it was slow on all three when I tested, and so I decided to check out my network on my way.
The only tool the that spot a suspicious activity from my network was my router, a cheap one, DIR-300. I tried to gather information from four possible sources as shown in this screenshot http://i.imgur.com/9MyOXgY.png .
First page: Gateway session activity page.
Second page: IP address reverse lookup results: Verizon??? I don't think I'm using any of their services, and to make ir worse, on PORT 11106, aka SGI LK Licensing service.
Third page: Nothing found on Wireshark for that port.
Fourth page: NMAP with Backtrack running on VMware.
Am I taking the wrong route to find out what is causing this traffic?
What is the most effective way to check out malicious connection activity on my network?
Is it possible to know how much packets are received and sent from a certain tcp connection on my router?