0

At my workplace we tend to get those annoying captchas once in a while when we are trying for search something in Google.

When we got into that page it says that our network is trying to access Google pretty fast and in multiple times. We are suspecting that there's a computer which is infected with some kind of virus or script which is running in the background and trying to do something with Google or other hosts.

I was wondering what tool I can use in Linux to discover the bad node in the network or how can I start to debug this problem.

  • 2
    It would be easiest to go directly to the network layer to find this. On a single edge device performing a very basic gateway/NAT role, there is often a way to view current inside/out translations- on a Cisco device it would be a command like "show conn" - unless you happen to have a linux box as a gateway (my favorite, since for one, you can 'tcpdump' the whole stream easily in cases like yours,) check the network gear. – rhoyerboat Jun 23 '15 at 8:27
1

I would probably start by using tcpdump to find the culprit.

If you have a router that runs linux (many of them do), you can often run tcpdump right on your router.

If not, you could try running tcpdump (or wireshark) on a PC that's on the same network as your router. This doesn't always work because ethernet switches don't always copy all traffic to all the ports. In this case, you would have to set up a machine as a router and put it in between your outside router and your internal network and then you can run tcpdump on that.

Or you could find an old ethernet hub that doesn't do switching. I have an old one lying around in my kit for that purpose!

Once you have a place you can reliably tcpdump from and see your network traffic that exits your network, start by finding google's ip addresses like this:

$ host google.com
google.com has address 74.125.21.100
google.com has address 74.125.21.113
google.com has address 74.125.21.138
google.com has address 74.125.21.139
google.com has address 74.125.21.101
google.com has address 74.125.21.102
google.com has IPv6 address 2607:f8b0:4002:c06::8b
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 20 alt1.aspmx.l.google.com.
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.
google.com mail is handled by 10 aspmx.l.google.com.

Those 74.125.21.X addresses may be different from your vantage point on the net. To find out what traffic is hitting those addresses in tcpdump, use a command like this:

tcpdump dst host 173.194.219.113 or dst host 173.194.219.139 or dst host 173.194.219.100 or dst host 173.194.219.138 or dst host 173.194.219.102 or dst host 173.194.219.101

Now sit back and watch and see if you can spot one single host hitting google way more than another.

You may want to dump the output of tcpdump into a file and use some scripting to sort it later. Save the tcpdump into a tmp like this (replace ... with arg list from above):

tcpdump ... > /tmp/x

then let that run for a while and ^C it. Then use this to find out who the biggest users of google are:

awk '{ print $3 }' /tmp/x | uniq -c | sort -n

The tricky part of all of this is going to be getting a machine that you can run tcpdump on that can view all the network traffic.

  • Thank you Michael for your response I'll take a look at this and I'll let you know the output. – VaTo Jun 25 '15 at 0:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.