Win2K intrusion detection case study (2)


 Method Two

In a not very busy and a simple computer network traffic indicator, that is a task for the network adapter icon.Create step is: Select "Start / Settings / Control Panel", click on "Network and Dial-up Connections", right click on the "local connection", select "Properties", select "Connect Show icon in taskbar" check box:



Thus, with all the information out of the network, there will be an icon in the taskbar blinking light:



Method Three

If you suspect they have been scanned, you can use a built-in command-line tool netstat.Type the following command:

Netstat-p tcp-n

If the current is being scanned, the scanning tools used will be similar to the following results:

Active Connections

Proto Local Address Foreign Address State

TCP 127.13.18.201:2572 127.199.34.42:135 TIME_WA99v

TCP 127.13.18.201:2984 127.199.34.42:1027 TIME_WA99v

TCP 127.13.18.201:3106 127.199.34.42:1444 SYN_SENT

TCP 127.13.18.201:3107 127.199.34.42:1445 SYN_SENT

TCP 127.13.18.201:3108 127.199.34.42:1446 SYN_SENT

TCP 127.13.18.201:3109 127.199.34.42:1447 SYN_SENT

TCP 127.13.18.201:3110 127.199.34.42:1448 SYN_SENT

TCP 127.13.18.201:3111 127.199.34.42:1449 SYN_SENT

TCP 127.13.18.201:3112 127.199.34.42:1450 SYN_SENT

TCP 127.13.18.201:3113 127.199.34.42:1451 SYN_SENT

TCP 127.13.18.201:3114 127.199.34.42:1452 SYN_SENT

Above information, we should focus attention on the local and external addresses and a large number of consecutive ports SYN_SENT information.Some scan tools will show ESTABLISHED or TIME_WA99v information.In short, information is the key to continuous port sequence and a large number of connections from the same host.