Windows Forum
Hi,
How do someone find out which station on the network is sending huge amount of outbound packet? A few stations on our network are infected with W32/Nachi-A. I think it is the virus that is causing the traffic jam.
Please help
by lumberjack
I am no guru on this but I am pretty sure yopu will need a network analysis tool, eg Sniffer
from Network Associates. But i am sure there are cheaper options.
check out google and search for "Network Analyser"
or "Network Analyzer"!
by edmond_sng
Poster rated this answer.
by jim-h
Lumber is on the right track there, Network Tools are probably what you are looking for here. I am not sure what your Network Elements are consisting of but if SNMP is an option you may want to try to use some traffic trending tools that are available for free.
http://cricket.sourceforge.net/
http://mrtg.hdl.com/mrtg.html
http://linas.org/linux/NMS.html
One other option that comes to mind if you have Cisco gear is to utilize ?IP Accounting? or ?Netflow?.
Good Luck!
Jim
by edmond_sng
Poster rated this answer.
by centauri
On the other hand, you could look for the footprint of the Nachi worm. It puts two files in the C:\WINNT\SYSTEM32\WINS directory (this will be C:\WINDOWS\SYSTEM32\WINS on Win XP) called DLLHOST.EXE and SVCHOST.EXE, both of which the worm registers as services. If everyone runs a login script, you could have one of the standalone cleaners (Symantec has one at http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html) run at login for a few days. Since this is the anti-Blaster worm, it has ready downloaded and installed the Microsoft DCOM/RPC patch.
If you have access to a Linux/Unix box, you could run tcpdump and look for packets scanning port 135 (the MS RPC port). Also the program Ethereal is an open source network analyzer that runs on Windows (http://www.ethereal.com).
by edmond_sng
Poster rated this answer.
by edmond_sng
This discussion is closed to new replies.
Sort by Trending