Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have 24 PCs in a network. I believe 1 or more PCs are compromised, and is consuming all our bandwidth.

Can anyone recommend a tool to find out infected PCs from our network.

share|improve this question
You don't mention what tools you have in place...what kind of router? Anything with SNMP monitoring? How do you see what bandwidth is taken? – Bart Silverstrim Mar 2 '11 at 19:09
How do you know this is the cause of your bandwidth consumption? How are you measuring your bandwidth usage? – Coops Mar 2 '11 at 21:29

Installing wireshark should give you an indication of which machine is the culprit, as it will fill the screen with traffic from the infected IP. This will require you to either be plugged into an inline hub, as it will "absorb" all network traffic, and allow you to analyze it, or use some type of switchport monitoring.

Are you running any type of central AV that you can look at and check the logs? How about the switch, is it managed? Can you log into it?

An easy way would be to look at your switch(s). If you have a machine that is blasting a ton of traffic, you may see a port that is maxed out, I've used this method countless times at places where there just isn't any type of monitoring or filtering going on. You could also either pull network cables from the switch one by one until it stops and look at your documentation for which machine is plugged into that port, or start shutting down machines until the traffic subsides.

share|improve this answer

Depednds you have a firewall or web filter? If so you can start there and see where your bandwidth is being allocated to. You could also sniff the network and find out where a lot of these packets are being sent to and then dial in the IP that is doing it.

share|improve this answer

The easiest but time consuming is to scan all, not that many, with a very efficient tool like malwarebytes. It cleaned a laptop full of trojans and spyware for me. In two reboots. Amazing.

share|improve this answer

Another option is to run netstat on the systems and see which one is filling up the tables with random connection attempts.

share|improve this answer

If you can see the router, you should be able to see which port has constant activity. Pulling the plug on it should resolve your bandwidth issue. (Make sure it isn't the server.) If the network wiring is well documented, you can find the host from the documentation without pulling the plug.

If you have a managed router, you can check the activity counters on the ports. Look for the ones that have the counters increasing fastest. You should be able to get the MAC address active on the ports and trace that back to the host. Use ARP to get the IP address. Trace the IP address to the name of the host.

You can do the same on a PC by PC basis by looking at their network counters or the activity lights on their Ethernet interface.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.