Discussion on:

How to track down malware from your firewall with basic tools

Thanks for this article. I am just reading Kevin Mitnicks book "The art of Intrusion" and am getting paranoid about my system. Now I am going to investigate what some of these applications are supposed to be doing on my XP professional system.

It seems like using the -b would be a good thing since it shows the executable involved in the connection. How would it cause you to possibly miss the connection just because it slows down the output from the command? Wouldn't the output still be on the screen if I just scrolled up? Or is it because the infection itself may somehow filter the results of the command if -b is used? I'm just trying to understand why the delay in the output from the command when -b is used would cause me to miss the connection I'm looking for?