Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What tools are available that allow me to monitor if someone is using a port sniffer on my computer and/or display any possible hacking attempts? I'm using OneCare, but the firewall information is quite limited (AFAICT). Are there any tools to download that could monitor any suspicious incoming activity?

Thanks

share|improve this question

4 Answers 4

up vote 3 down vote accepted

It depends of your network setup:

Almost all router have an integrated firewall, and you probably have one, so almost all ingoing network attacks will be blocked before your computer see them... So you must look in your router config for parameters and logs...

To monitor network devices there's essentially two protocols: Syslog and SNMP

If your actual router/setup is not sufficient, with the dd-wrt firmware you could get almost all professional router features (so, advanced logging) on a home router (if it's compatible and have enough cpu power and memory). (OpenWRT and Tomato are popular alternative too, but have less compatible device and/or are less user-friendly)

(Server side software: built-in Windows Server SNMP service - list of windows syslog server in this serverfault question - linux built-in syslogd - or alternative daemon: rsyslog / syslog-ng (this one have a windows port, in Cygwin packages))

Hosts monitoring

Nevertheless, if your network is partialy/totaly open or your computer is connected directly, and to monitoring outgoing suspect activities:

Comodo Internet Security is a good free firewall and it allows to log any matched rule. (Online Free Armor & PC Tools Firewall Plus have received good reviews too, but I don't use them and I don't know about their capabilities to log)

(It contains also a very good HIPS (host-based intrusion prevention system) but if you want a dedicated product: Threatfire and Winpatrol have good reputation.)

More network inspection

As it was suggested by qwertyKid, you could make a step further with packets inspection and Wireshark is certainly the most powerful tool to do it.
(It's also a good idea to use a hub/smart switch to relay packets to inspect what's incoming in your network, but be careful, relay packets only to an unsensitive and well protected computer...)

Alternatively you could use more simple tools like those from NirSoft:
  • CurrPorts: displays the list of all currently opened TCP/IP and UDP ports and the process that use it
  • SmartSniff: capture TCP/IP packets that pass through your network adapter, and view the captured data as sequence of conversations between clients and servers.
  • IPNetInfo allows you to easily find all available information about an IP address: The owner of the IP address, the country/state name, IP addresses range, contact information (address, phone, fax, and email), and more.
  • WhoisThisDomain allows you to easily get information about a registered domain.

More general security

If your computer is compromise, the network monitoring and inspection could be totally useless, so the first step to do is to secure it:

And as humans are the weakest part of computer's security, be careful at what you do...

share|improve this answer

You can setup wireshark on your computer, which will be able to tell you which packets are coming and going from your system.

if you want to do this for the entire network, you will need to either use a hub or a smart switch that allows the port you are connecting to physically, to relay all packets to it, not just the predefined (by mac address's) destinations.

share|improve this answer

The solution you are looking for is generally know as "Intrusion Detection Systems" or IDS. There are tons and tons of these tools out there. Ask on serverfault.com for IDS recommendations (or search, maybe someone already has)

share|improve this answer

If you are just trying to gather stats on that sort of thing you could run something like tinyhoneypot. That will monitor any ports on your system that aren't actually in use. So it will appear to the outside like you have tons of stuff open. It's just a simple low interaction honeypot. If you really get into that sort of thing I have found the book "Virtual Honeypots" to be great.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.