LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 07-17-2009, 06:07 AM   #1
dlugasx
Member
 
Registered: Dec 2008
Location: Germany/Poland
Distribution: CentOS / Debian / Solaris / RedHat
Posts: 249

Rep: Reputation: 18
Infected PC in LAN- sending packets to the internet - How to detect machine ?


Hi all,

I have a realy big problem. In my network I have 25 workstations and some serves. Everything working in local lan with firewall.

The problem is that on one machine (I dont know which one) is installed software which sending data to the internet. Actualy I dont know what it is. Last time as I remember was trojan which can create new network interfaces in windows and send some data to the internet.

The half speed of my network connection is used by this infected machine.
How can I detect which machine it is ?


How can I listen/capture some traffic and analize from which machine I have more connections.

Please take a look on this time.Instead of 141-150ms should be 4-5ms.

64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=1 ttl=249 time=141 ms
64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=2 ttl=249 time=135 ms
64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=3 ttl=249 time=147 ms
64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=4 ttl=249 time=127 ms
64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=5 ttl=249 time=156 ms
64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=6 ttl=249 time=129 ms
64 bytes from web30.ispnetz.de (62.xx.191.74): icmp_seq=7 ttl=249 time=188 ms



How can I detect which machine is infected using only linux and keyboard ?


cheers

Dlugasx
 
Old 07-17-2009, 06:24 AM   #2
zQUEz
Member
 
Registered: Jun 2007
Distribution: Fedora, RHEL, Centos
Posts: 294

Rep: Reputation: 53
Quote:
Originally Posted by dlugasx View Post
"....How can I listen/capture some traffic and analize from which machine I have more connections......"
You could use tcpdump to capture network traffic in promiscuous mode, then import that into Wireshark and generate a statistics report.
 
Old 07-17-2009, 06:36 AM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,369
Blog Entries: 54

Rep: Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870Reputation: 2870
If you have any workstations or servers running mcrsft products I'd check them out. If you can't run remote diagnostics using Altiris or equivalent then you'll have to walk all the way to each machine and perform AV/Malware scanning there. Please note that keeping things safe should prevail over arguments like "I don't want to" or "can't disturb workers". if that doesn't hit home let me rephrase that: if infected machines infect or harm other machines on the 'net, allowing such a situation to exist may well hold a liability for the company you work for and is a clear threat to other Internet users. It wouldn't be the first time an ISP cuts off network access on the basis of malware activity. And I agree with that completely.
 
Old 07-17-2009, 06:52 AM   #4
dlugasx
Member
 
Registered: Dec 2008
Location: Germany/Poland
Distribution: CentOS / Debian / Solaris / RedHat
Posts: 249

Original Poster
Rep: Reputation: 18
Quote:
Originally Posted by zQUEz View Post
You could use tcpdump to capture network traffic in promiscuous mode, then import that into Wireshark and generate a statistics report.
Could You give me short instruction how to do it ?
 
Old 07-18-2009, 10:16 AM   #5
OlRoy
Member
 
Registered: Dec 2002
Posts: 304

Rep: Reputation: 86
Is the "network is slow" the only reason you think a computer is sending excessive traffic to the Internet, or were you notified by your ISP or a 3rd party? It could be anything from malware to P2P software, or it could be anything from a problem with your ISP to a hardware problem on your network. Do you have any idea what kind of traffic you are looking for? I'd try something like WireShark which is much more user friendly than TCPdump, and look at the Protocol Hierarchy Statistics and the Conversations under the Statistics menu.
 
Old 07-24-2009, 03:47 PM   #6
Suncoast
Member
 
Registered: Apr 2009
Location: Largo, Florida
Distribution: Slackware
Posts: 202

Rep: Reputation: 35
I'm going to assume you do not have Managed Network Devices. Meaning you can't login to and monitor your switches.

So, how about some low-tech ways to figure out the problem? Tell your Mate, your Mother or your Cat you will be late for dinner.

Tell all employees to leave their computers running for the night. After everyone has gone home, look at the lights on the switches and any routers on your network. Identify which ports on the switches are still active, then figure which workstations they connect to. Now you know which PC's are generating all the traffic. IF all the activity lights are flashing at the same time, you have a broadcast problem. Running tcpdump all by itself on the command line will show these broadcasts and their source MAC. If you have multiple switches connected together, make sure you have not created a "loop" in the wiring. You're only talking about 25 hosts, all this should not take long.

Then disconnect everyone from the Internet except yourself and see if your network speed improves. If you believe it is still too slow, you will probably need to talk to your ISP. Depending on what router/gateway device you are using to connect to the Internet, there are monitoring tools like mrtg that will monitor how much of your bandwidth you are using. You may be paying for a T1 1.54MBPS frame relay link, but how do you know if you're actually getting it? Are you hosting a public web server at your location? See if your ISP does server or rack hosting to move the server off your connection to the ISP. Usually much cheaper than paying for more bandwidth.

Last edited by Suncoast; 07-24-2009 at 04:01 PM. Reason: Clarification
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
LAN hacked - how to find infected machine dlugasx Linux - Security 10 07-03-2009 04:16 PM
Sending a wake-on-lan packet over the internet matthias_k Linux - Networking 4 11-19-2007 05:45 PM
Configure Internet connection through LAN - windows machine Micik Mandriva 17 07-23-2007 06:33 AM
locate infected machine from dhcp server erimar77 Linux - General 2 05-20-2006 09:33 AM
Should I go this way? 2 Machine Lan (X-over cable) + usb modem internet? Mad Malc Debian 3 06-27-2004 05:57 AM


All times are GMT -5. The time now is 03:25 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration