Tools to monitor hack attempts/port sniffing

Question

What tools are available that allow me to monitor if someone is using a port sniffer on my computer and/or display any possible hacking attempts? I'm using OneCare, but the firewall information is quite limited (AFAICT). Are there any tools to download that could monitor any suspicious incoming activity?

Thanks

Answer 1

It depends of your network setup:

Almost all router have an integrated firewall, and you probably have one, so almost all ingoing network attacks will be blocked before your computer see them... So you must look in your router config for parameters and logs...

To monitor network devices there's essentially two protocols: Syslog and SNMP

If your actual router/setup is not sufficient, with the dd-wrt firmware you could get almost all professional router features (so, advanced logging) on a home router (if it's compatible and have enough cpu power and memory). (OpenWRT and Tomato are popular alternative too, but have less compatible device and/or are less user-friendly)

• And here are some windows clients/logs analysis tools for syslog and snmp :
  • Wallwatcher
  • SNMP Trap Watcher
  • SNMPLog
  • LinkLogger (50$)
  • Kiwi Log Viewer (60€)
• And some, more general, logs analysis tools:
  • LogViewer Pro
  • BareTail

(Server side software: built-in Windows Server SNMP service - list of windows syslog server in this serverfault question - linux built-in syslogd - or alternative daemon: rsyslog / syslog-ng (this one have a windows port, in Cygwin packages))

Hosts monitoring

Nevertheless, if your network is partialy/totaly open or your computer is connected directly, and to monitoring outgoing suspect activities:

Comodo Internet Security is a good free firewall and it allows to log any matched rule. (Online Free Armor & PC Tools Firewall Plus have received good reviews too, but I don't use them and I don't know about their capabilities to log)

(It contains also a very good HIPS (host-based intrusion prevention system) but if you want a dedicated product: Threatfire and Winpatrol have good reputation.)

More network inspection

As it was suggested by qwertyKid, you could make a step further with packets inspection and Wireshark is certainly the most powerful tool to do it.
(It's also a good idea to use a hub/smart switch to relay packets to inspect what's incoming in your network, but be careful, relay packets only to an unsensitive and well protected computer...)

Alternatively you could use more simple tools like those from NirSoft:

• CurrPorts: displays the list of all currently opened TCP/IP and UDP ports and the process that use it
• SmartSniff: capture TCP/IP packets that pass through your network adapter, and view the captured data as sequence of conversations between clients and servers.
• IPNetInfo allows you to easily find all available information about an IP address: The owner of the IP address, the country/state name, IP addresses range, contact information (address, phone, fax, and email), and more.
• WhoisThisDomain allows you to easily get information about a registered domain.

More general security

If your computer is compromise, the network monitoring and inspection could be totally useless, so the first step to do is to secure it:

• Install a good antivirus: Microsoft Security Essential and Avira are good choice and free.
• Occasionally use a more specialized anti-rootkit: RootkitRevealer or Gmer
• Occasionally use an alternative on-demand antivirus scanner: Kaspersky Virus Removal Tool, Malwarebytes' AntiMalware or one of the many web-based

And as humans are the weakest part of computer's security, be careful at what you do...

Answer 2

You can setup wireshark on your computer, which will be able to tell you which packets are coming and going from your system.

if you want to do this for the entire network, you will need to either use a hub or a smart switch that allows the port you are connecting to physically, to relay all packets to it, not just the predefined (by mac address's) destinations.

Answer 3

The solution you are looking for is generally know as "Intrusion Detection Systems" or IDS. There are tons and tons of these tools out there. Ask on serverfault.com for IDS recommendations (or search, maybe someone already has)

Answer 4

If you are just trying to gather stats on that sort of thing you could run something like tinyhoneypot. That will monitor any ports on your system that aren't actually in use. So it will appear to the outside like you have tons of stuff open. It's just a simple low interaction honeypot. If you really get into that sort of thing I have found the book "Virtual Honeypots" to be great.