0

Some of our computers in our company has been infected with the worm Conficker. We don't know the source of the infection, but I want to monitoring the outside activity to see if we are still infected (we have already "protect" some computers). That's important to ensure that I can ask for being unlisted.

My question is: which means does I have to monitor the whole outbound traffic from my source IP, and/or the specific trafic to a concrete IP, and/or the outbound traffic in a port-based manner (the traffic from each port together with its destination port/IP), everything remotely (outside the infected network)?

I don't ask here for ways to detect infected PCs, but to see the outside activity as an indirect proof of "cleanliness".

You can see our IP and the description of our infection from the following link:

http://cbl.abuseat.org/lookup.cgi?ip=79.108.33.94&.pubmit=Lookup

The destination IP is 216.66.15.109. If I dig in it:

 $ dig -x 79.108.33.94
 109.64-26.15.66.216.in-addr.arpa. 3600 IN PTR  sinkhole-iad1-1.cwg.fsi.io.

No surprises here (clearly stated as a sinkhole).

I can explore from home (Ubuntu 14.04), but, if my ISP or router blocks me in some way, I can ssh-connect to a public server of our company (Ubuntu Server 14.04) to scan from there. So, let's assume I've no restrictions to make that sort of scanning.

1

If your router is rflow enabled, you can have it report in to an external computer running a rflow collector.

Example for a ddwrt router: http://www.dd-wrt.com/wiki/index.php/Using_RFlow_Collector_and_MySQL_To_Gather_Traffic_Information

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.