Killing Spam Zombies Made Easy - Identifying Suspect Systems

Now that you've identified that your network has unexplained traffic that could be due to a spam zombie, you need to locate the system or systems that are responsible for it.

Most system administrators will have tools to monitor network traffic, and will easily be able to locate the suspect system. The steps listed below offer some crude, but effect ways to figure out the source of the questionable network activity.

In very small networks with only a handful of systems, it may be easiest to go computer to computer. Almost all network cards have between one and three lights on them. Most cards have a "Link" light to indicate a network connection and either one or two traffic lights indicating that data is being transmitted and or received. Some cards have a single light to indicate all these functions. One way or the other, the system responsible should have a light that's visually identifiable as being "active".

That flashing light just might be a visual representation of spam e-mail landing in thousands of user's inboxes.

In extreme cases the traffic light may be pegged on constantly, which can make it hard to identify. If you're not able to locate the suspect box by looking at the network cards, it may help to examine the hubs or switches.

Most "hubs" are really "switches" which route traffic to only the computer it's intended for. Switches generally have a separate traffic light for each node (computer) on the network. Older hubs may not have this functionality, in which case you may need to resort to looking at each system as described above.

In larger networks with multiple cascaded hubs or switches, it may be necessary to trace the traffic through a number of different levels.

Next: Capturing and Evaluating Network Traffic >>