Some of our computers in our company has been infected with the worm Conficker. We don't know the source of the infection, but I want to monitoring the outside activity to see if we are still infected (we have already "protect" some computers). That's important to ensure that I can ask for being unlisted.

My question is: which means does I have to monitor the whole outbound traffic from my source IP, and/or the specific trafic to a concrete IP, and/or the outbound traffic in a port-based manner (the traffic from each port together with its destination port/IP), everything remotely (outside the infected network)?

I don't ask here for ways to detect infected PCs, but to see the outside activity as an indirect proof of "cleanliness".

You can see our IP and the description of our infection from the following link:


The destination IP is If I dig in it:

 $ dig -x
 109.64- 3600 IN PTR  sinkhole-iad1-1.cwg.fsi.io.

No surprises here (clearly stated as a sinkhole).

I can explore from home (Ubuntu 14.04), but, if my ISP or router blocks me in some way, I can ssh-connect to a public server of our company (Ubuntu Server 14.04) to scan from there. So, let's assume I've no restrictions to make that sort of scanning.


If your router is rflow enabled, you can have it report in to an external computer running a rflow collector.

Example for a ddwrt router: http://www.dd-wrt.com/wiki/index.php/Using_RFlow_Collector_and_MySQL_To_Gather_Traffic_Information

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.