Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have about 15 computers on a local network behind simple TP-LINK TL-WR340G router. Everything works fine and the router does its job.

Recently we were informed that port scanning is being performed from inside of our network.

How can I detect which computer is doing port scanning?

I'm using Win XP and i'm Linux literate. So simple step-by-step instructions would be great.

Additional information:

  1. TL-WR340G is a very basic router - I did not find any useful logs.
  2. The network is wireless.

Additional information 2010-07-06:

I was able to burn backtrack-linux. My notebook is SL300 with Intel 5100. Running Wireshark on wlan0 shows only traffic to/from my computer and broadcasts. Same with other tools. I put my card on monitor mode with some airmon-ng script. I received some control packages on mon0 after that. I was able to decrypt it with WEP key with Wireshark, but I was not able to interpret it as IP for further analysis. I'm not sure if I received full traffic or only my notebook related.

Is it possible to sniff all wifi traffic and convert it to IP for further analysis?

share|improve this question
1  
re: only seeing broadcasts & traffic for your host -- that's normal behavior for a router or switch. You'd need a hub, a router that'd allow you to clone the traffic for sniffing, or something to masquerade as the router (see Nick Kavadias's response) –  Joe H. Jul 6 '10 at 16:29
    
Re "Is it possible to sniff all wifi traffic and convert it to IP for further analysis?" - If your main concern is port scanning, you should focus on IP traffic first. Worry about the Wifi traffic later. Wifi sniffing can be a whole other ballpark, especially with any sort of Wifi encryption. –  Stefan Lasiewski Jul 6 '10 at 17:21
    
@Stefan - yes. I wish to focus on IP but have some problems sniffing it as described. The idea with WiFi was meant to remedy it. –  agsamek Jul 7 '10 at 7:59

6 Answers 6

up vote 3 down vote accepted

This is a bit of a crazy idea and it would involve some network down time but it sounds like your options are limited by your cheap gateway, with no way to see what's being NAT'd.

Change the IP address of your gateway to something else, then disable DHCP to prevent any machines finding out new gateway address. Boot-up a machine running ethereal/wireshark taking over the old IP address of your gateway.

The offending machine should come up like christmas lights, now that the machine doing the packet sniffing IS the gateway!

share|improve this answer
    
+1 This is a good idea. I can also setup my PC as access point and connect to the router with WIFI off. Could you write a few words how to setup this with backtrack or some other distro? –  agsamek Jul 7 '10 at 7:56
    
Why make your pc the AP? No need to use. Bactrack. Setup a static ip on your pc to be the gateway ip and start wireshark. –  Nick Kavadias Jul 7 '10 at 15:34
    
@Nick I'll try this. How can I route all traffic with Linux to my router? –  agsamek Jul 8 '10 at 8:28
    
why do you want to do that? –  Nick Kavadias Jul 8 '10 at 12:22
    
@Nick - I'd like to keep everything working and put my machine in the middle to see the network traffic. Is there other option? This was also the idea with setting up Access Point. I cannot put the network down for an hour. –  agsamek Jul 8 '10 at 15:49

You should check NAT log of your router so that if someone from the outside world give you source ports and time of the port scan you can check on your router logs to find the corresponding inside computer.
If your router can't keep NAT log you probably want to buy a new one because looking at logs is really the only way to have a 100% good result

share|improve this answer
    
This should be the right way. It just doesn't work with my scenario. –  agsamek Jul 7 '10 at 8:01

You could use wireshark to monitor incoming network packets, and look for abnormal behavior (ARP "who has" type of requests - only dns servers should be doing those a lot).

Same thing can be done with tcpdump:

tcpdump -l -n arp | egrep 'arp who-has' | head -100 | awk '{ print $NF }' |sort | uniq -c | sort -n
share|improve this answer
    
thanks. I didn't try tcpdump but wireshark only. I've added some more information in the question. –  agsamek Jul 6 '10 at 16:05
    
@agsamek: using tcpdump or wireshark is almost the same –  radius Jul 6 '10 at 18:02
    
If scan is only performed to the outside he will see no stange arp trafic –  radius Jul 6 '10 at 18:04

Imagine the scanning is going on a continous rate:

  • Connect a laptop or select a station on the same LAN where the computers are.
  • Launch a graphical software to watch packets, like INAV or etherape or rumint
  • Watch for the host doing connections on many ports

On the other hand, if there's only scanning on certain periods, you could install snort and wait for the 'port scanning' event.

Except for etherape, I think that all these tools run on Windows. If you don't want to mess with installing them, you could try a Linux security liveCD like backtrack.

In any case, remember to implement outward rules on the router to known used ports (e.g., 80, 443, etc.) to limit the scans.

share|improve this answer
    
I just burned backtrack. The scanning occurs continuously. Could you write some example commands I could use in backtrack to find the machine? –  agsamek Jul 6 '10 at 13:41
    
For instance, you can launch etherape and listen to the network. You should see a list of hosts arranged as a circle with lines from them. Look for the host with the wider line and connections. This should be the offending host. See this screenshot etherape.sourceforge.net/images/v0.9.3.png –  chmeee Jul 6 '10 at 15:22
    
Thanks - I tried this and it seems to be the right software. The problem is that it presents only my notebook related traffic and broadcasts. No information about other computers. I added some more information to the question. –  agsamek Jul 6 '10 at 16:03

From earlier experience I used to have software firewalls that warned my that other computers were portscanning.

I have also checked the log of my filezilla ftp server which gave me the IP from every computer that scanned me.

Have you checked the logs on tl-wr340G router?

share|improve this answer

You can plug an IDS like Snort on your switch monitoring port if any. I think a little googling will give you preconfigured virtual machines with Snort and Base installed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.