Can I tell from "netstat" if someone is snooping my computer?

Question

I have many questions. However, to begin in the easiest and shortest manner. I am trying to figure out why when I type cmd prompt netstat -a I get a plethora of IP addresses and links that I am almost certain are not right or correct.

Or maybe my IT/computer networking hubby snooping. I have absolutely nothing to hide and can't figure out why he would be concerned. With his level of network security training a "leak" in my home wireless net, makes no sense.

So, I want to find out if he is indeed snooping. What should I look for to be considered; harmful? Is UDP necessary?

Below are a few:

TCP    my ip address here:49372    server-205-251-203-249:80  ESTABLISHED
TCP   my ip:49388    star-01-02-lax1:80     ESTABLISHED
 TCP    :49443    r-199-59-148-16:443    TIME_WAIT
 TCP    :49448    209-18-46-66:80        ESTABLISHED
 TCP    :49449    a96-7-48-51:80         ESTABLISHED
 TCP    :49450    65.55.25.44:80         ESTABLISHED
 TCP    :49451    a96-7-48-64:80         ESTABLISHED
 TCP    :49454    65.55.184.15:443       ESTABLISHED
 TCP    :49455    TheTank:445            SYN_SENT
 TCP    :49456    TheTank:445            SYN_SENT
 TCP    :49457    TheTank:445            SYN_SENT
 TCP    :49458    TheTank:139            SYN_SENT
 TCP    :49459    android_f2f09956193035b1:9100  SYN_SENT
 TCP    :49460    dfw06s17-in-f7:443     ESTABLISHED

Funny thing is he just bought an Android phone last week (prior we had iPhones) and suddenly I see the above ANDROID_F… in the command output.

Answer 1

The problem with how you're using netstat is, you're missing out on the really digestable information

try netstat -ba - this will give you the name of the binary of programme using the port and hostname and a will give you all the ports being used. If you want IP addresses use netstat -ban

I note that computers are chatty little things. They're constantly telling each other "I'm here" "This is my IP address BACK OFF!" and even talking to themselves (really!). Unless you KNOW exactly what you're looking for, there's just too much noise.

Answer 2

you're looking at everything that your network port sees. there is a lot more going on at the networking level than you expect.

the presence of "android_" simply means the iphone is on the network, or has been plugged in with the tether option.

And, my philosophy while on the computer is to act like someone is always watching. This way you don't get into any trouble (or cover your tracks extra well).

Answer 3

First update your antivirus, inspect any exemptions of files or folders and question if you find anything that is exempt from being scanned, then run a full scan. Then you could narrow down things by looking through your firewall rules and see if anything looks out of place. Based on if you identify anything that looks out of place then research to see if they are legitimate or not. To get more advanced if you don't find anything at this point then you could narrow down what to inspect as a packet capture by running a local Honeypot. (It's recommended to disable or even uninstall any antivirus applications because of how these think and act.)

http://lmgtfy.com/?q=windows+honeypot

Then based on your findings of traffic and Googling what all you are seeing identify some possible suspicious activity.

Second get wireshark and take a packet capture and then dissect it based on your previous findings of possible suspicious activity. If this is too complex you could just start creating firewall rules to block everything that you found previously from running a Honeypot and see if any of the rules are magically disabled or deleted by someone and then you would know the culprit. Below is a good script I wrote to export your current firewall rules in a trackable and easily readable manner:

cd\
mkdir "C:\Windows Firewall Configs"
cd "C:\Windows Firewall Configs"
netsh advfirewall firewall show rule name=all > "C:\Windows Firewall Configs\Firewall Rules Export-%computername%-%date:~4,2%-%date:~7,2%-%date:~-4%.txt"
netsh advfirewall export > "C:\Windows Firewall Configs\Firewall Rules Export-%computername%-%date:~4,2%-%date:~7,2%-%date:~-4%.wfw"

This will create 2 files in the folder named "Windows Firewall Configs" on your C drive.

Firewall Rules Export-YourComputerName-MM-DD-YYYY.txt
Firewall Rules Export-YourComputerName-MM-DD-YYYY.wfw

The txt files are human readable while the wfw file is an actual export / backup of your existing windows firewall rules. If you need to import a previous backup then run:

netsh advfirewall import "C:\Windows Firewall Configs\Firewall Rules Export-YourComputerName-MM-DD-YYYY.wfw"

You could simply copy and paste everything into a .CMD file and use task scheduler to schedule a daily backup, then over time determine the changes that were made using something free like WinMerge to compare two files and see what's different and arrive at a conclusion based on that evidence.