How do I snoop unauthorised traffic

One of the Windows 2000 boxs is sending data out of the network to some host
on the internet. My gateway is Mandrake Linux 8.2 running straight
iptables. I've tried tcpdump against the internet facing NIC but the data
are inconclusive.

How do I determine what traffic is leaving the network and determine what
host it is being sent to, then what string do I use in
the /etc/sysconfig/iptables file to block it?

Thanks
Peter

On 2006-09-11, Peter Lowrie <(E-Mail Removed)> wrote:
> How do I determine what traffic is leaving the network and determine what
> host it is being sent to, then what string do I use in
> the /etc/sysconfig/iptables file to block it?

Use iptraf to check the info, then block all the incoming/outgoing
trafic to such ipaddress. See the iptables-howto.

Davide

--
Grown-up Operative System: old enough to drink, old enough to vote,
old enough to drive, old enough to fsck
- Brian Kantor and Anthony de Boer on asr

On Tue, 12 Sep 2006, in the Usenet newsgroup comp.os.linux.networking, in
article <(E-Mail Removed)>, Peter Lowrie wrote:

>One of the Windows 2000 boxs is sending data out of the network to some host
>on the internet.

1. Disconnect the windoze box
2. Ask the luser running it WTF they are doing.

>My gateway is Mandrake Linux 8.2

That's over four years old. Why are you running such an ancient UNSUPPORTED
release on the Internet? OK - saw your other post - you shouldn't have a
problem booting with anything current. What happens when you try? Does the
computer catch on fire or something? The packet errors you are reporting
suggest a problem with the NIC - possibly an interrupt being blocked by
some other process. As for the "slow" port 110, use tcpdump to see what
traffic is occurring. Is the POP server trying to Ident you (trying a
connect to your port 113)?

>running straight iptables.

OK, but the rules don't make much sense to me.

>I've tried tcpdump against the internet facing NIC but the data
>are inconclusive.

What is that supposed to mean? Is the stuff encrypted (like SSH traffic)?
Or is it that you merely don't understand IP and TCP headers?

>How do I determine what traffic is leaving the network

Disconnect the stupid windoze box, and ask the luser to explain. If they
can't, talk to your legal types, and remove the luser. Then make a copy
of the hard disk, and take the copy to a windoze expert.

>and determine what host it is being sent to

What is the source/destination IP address? If you are masquerading, run
tcpdump on the inside NIC, rather than the Internet side. You'd also want
to record what port numbers are being used on the source and destination
sides.

>then what string do I use in the /etc/sysconfig/iptables file to block it?

708351 Nov 14 2005 IP-Masquerade-HOWTO
17605 Jul 21 2004 Masquerading-Simple-HOWTO
278012 Jul 23 2002 Security-Quickstart-HOWTO

but the better solution is to find out what is running on the windoze box
and fix that.

Old guy

Peter Lowrie wrote:
> One of the Windows 2000 boxs is sending data out of the network to some host
> on the internet. My gateway is Mandrake Linux 8.2 running straight
> iptables. I've tried tcpdump against the internet facing NIC but the data
> are inconclusive.
>
> How do I determine what traffic is leaving the network and determine what
> host it is being sent to, then what string do I use in
> the /etc/sysconfig/iptables file to block it?

Windows is pretty talkative out-of-the-box. You probably want
to disable the ports 135 to 193 and 445 for both TCP and UDP.

--

Tauno Voipio
tauno voipio (at) iki fi

Peter Lowrie <(E-Mail Removed)> wrote in
news:(E-Mail Removed):

> One of the Windows 2000 boxs is sending data out of the network to some
> host on the internet. My gateway is Mandrake Linux 8.2 running straight
> iptables.

As others said. That's a pretty old version.

> I've tried tcpdump against the internet facing NIC but the
> data are inconclusive.

Why? tcpdump can capture everything there is to see. Of course if the data
is encrypted then it wont tell you much other than the source/dest ip and
port no's.

>
> How do I determine what traffic is leaving the network and determine
> what host it is being sent to,

tcpdump can certainly capture that. If you have difficulty with the output
from tcpdump I suggest you save the data to a file using the -w option.
Then inspect the file using a graphical program like ethereal which can
read tcpdump output files fine.

> then what string do I use in
> the /etc/sysconfig/iptables file to block it?

In the forward chain, add a rule that drops or rejects the packets you
don't like.

Klazmon.




>
> Thanks
> Peter