6 ms·
> IPv4 (TCP or SCTP) and dst port (43253 or 43753 or 63424 or 26424) So this is hiding network traffic from certain ports, which means that it should be easy e
by iso1631 4y ago
> IPv4 (TCP or SCTP) and dst port (43253 or 43753 or 63424 or 26424)
So this is hiding network traffic from certain ports, which means that it should be easy enough to spot on spanports or netflow data
Are there any good tools which detect malware from analysing network traffic, either things like machines doing wide range attempts to connect on 137/139/445, or burte forcing on 22 etc, but also for more advanced searches for traffic like this?
I see plenty of companies selling end point protection, but that's not much use with the amount of blackboxes I have on my network.
- survirtual 4y agoI wouldn’t mind having a hardware / software network analyzing combo. Could probably do something as a plugin for OpenWRT — check consistency, packet sizes, ports in use, outbound hosts, etc. Could auto flag suspicious endpoints for further analysis, and if found to be malware for anyone, gets shoved in a db and shared. Malware could always bounce traffic off of a known host but that would move the needle in any case.
- westmeal 4y agoI'd also like to know if there are any applications that can run off of the router. I'm not network savvy but the only thing I've done in the past is capture packets off of the LAN or WAN interfaces and read em later but thats hardly a good way to check your network...
- 0daystock 4y agoI save all SYN packets on my router, it's noisy but a useful audit trail: tcpdump "tcp[13] & 2 != 0" Yes, I'm aware malware could use UDP/ICMP. It could also domain-front on 443 and I'm not under any disillusion this adds meaningful resistance to malicious software; it's just interesting to observe.
- iso1631 4y agoSure, and perhaps handy once you are hit, but how do you check those for any teltale signs of infection before you know what you're specifically looking for