I've discovered that my home network IP address has ended up on several blacklists after spam traps received emails from this IP address. I've tested the one PC that uses this network, and it seems to be fine. That leaves the most likely culprit looking like one of the two Android devices on this network.

It could be a botnet infection (which apparently is starting to become a problem on Android), it could be a rogue app, or it might even be nothing to do with these devices.

I've asked on the Android site whether its possible to identify unsolicited outgoing emails from the devices themselves within Android, and so far it sounds like it probably isn't. I've looked into whether my router (a Huawei 3G mobile broadband router) keeps any logs or can monitor traffic, and it appears it can't.

Then I had the idea of using my PC as a mobile hotspot, connecting my Android devices to the PC, then using the PC to monitor outgoing traffic from the Android devices.

The problem is, I have no idea how to even begin doing something like this. Is it possible? Are there firewalls or network monitors that can monitor traffic from connected devices like this? What sort of software would I even be looking for?

Windows 8.1, if it's relevant.

  • If you suspect a botnet infection. Just nuke the devices. The chances of you finding and identifying a botnet infection, that your security software isn't already catching, is extremely unlikely. – Ramhound Apr 6 '16 at 16:58
  • The point is that I suspect (unconfirmed) some kind of rogue-email-sending infection on the Android devices and haven't yet found any Android security software that does a good job of even trying to look for such things. First I want to see if the rogue emails are even coming from one of these devices. Nuking every device on a network based on a hunch is pretty extreme! – user56reinstatemonica8 Apr 6 '16 at 17:13
  • You sense your Android device is infected. So backup your personal file and reset it? – Ramhound Apr 6 '16 at 17:18
  • That's the whole point of a UTM. – bwDraco Apr 6 '16 at 17:30
  • @bwDraco I've not come across that acronym before, can you elaborate? Do you mean in the sense of "Unified Threat Management"? Please keep in mind that this is a normal end-user home network, not a big corporate network. – user56reinstatemonica8 Apr 6 '16 at 17:38

You could try using pfsense liveCD (as an example) to turn your PC into a router appliance. You would need to be careful not to install to the PC (overwrite your hard drive).

As far as I know, it can be configured to use USB media to store configuration and log files. You can then put packet inspection/enable logging, check outbound connections on smtp ports etc to see if you can identify traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.