Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a network of about 40 machines running either Win XP or 7 in our office via LAN switches into 1 x Netgear Router (WNDR3700). We have noticed recently that our local network has been added to the CBL Blacklist due to one of our machines being infected with Torpig.

I have attempted to use Kaspersky's TDSSKiller Antirootkit Utility to find the infected machine but all appear to be clear.

The CBL register advises to find the local machine which is connection to the remote IP address (CBL has provided the range). However, our router does not have the ability to block remote IP addresses - does anyone know of a software which can log all the internet traffic, which we can then use to find the infected machine.

share|improve this question
Could you mirror the port on the switch that connects to the router and run Wireshark? You could then do a search for the remote IP address you are trying to block. Then you will be able to see the local IP of the infected machine. – dannymcc Dec 7 '12 at 11:16
@dannymcc - I've had a look at Wireshark, how do I go about 'mirroring' the port on the switch? – buzzmonkey Dec 7 '12 at 11:28
Just checked - our switch is a TP-LINK TL-SG1048 - can I mirror on this? – buzzmonkey Dec 7 '12 at 11:36
I sincerely doubt it. I can't see any proof of that being a managed switch. So you should try the ARP poisoning attack from my answer. But you'll make the switch into a hub in the process. – Tom O'Connor Dec 7 '12 at 11:44
Dd-wrt might be an option, and iptables:… – JustinC Dec 7 '12 at 13:17

Because you've got such a nasty cheap prosumer router, you're not going to be able to do anything really clever.

If your LAN switch is sane enough, you could SPAN/mirror the uplink port onto another port, bung a PC with wireshark on there, and hopefully capture the traffic.

There is one possible option, if your switch doesn't support SPAN/Mirror ports. Where you overload the ARP address table, and effectively make the switch into a hub. This is called an ARP poisoning attack.

If you had a Linux box with 2 NICs, you could put it in between the Router and the switch, effectively as another router, but running wireshark/tcpdump, and capturing all the traffic as it goes across your interfaces.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.