[Mickey Mouse]

Hi,

I am running Windows XP home edition and I am on cable. I get these Windows Messager popups. What is a good intrustion detection software so that I can trace down where these popups are coming from. Any suggestions?

Mickey

 

[newbiesecurity]

You don't need intrusion detection to monitor your connectons. You can use WireShark for monitoring your system and it is easier to use than most intrusion detection solutions. If you still want an intrusion detection solution, Snort is free and widely used.

 

[Mickey Mouse]

With either product, will I be able to trace the IP address of who is coming into my system?

 

[newbiesecurity]

You will be able to see the IP from where the traffic is originating. You can use traceroute to get some additional information about the ip. The attacker may not be attacking you from their machine, but from some other vulnerable machine they compromised. So having the ip information may not be very helpful unless you are going to add it to a firewall ruleset. It definitely sounds like you want a packet sniffer, WireShark, and not an intrusion detection solution. A simple solution to this problem is to put a router with NAT capabilities between your computer and your cable modem. If they are connecting to your Windows Messenger service, then I imagine you are not running a firewall, at least not one configured very well. ZoneAlarm is a free firewall.

Good luck.

 

[cybertech]

Turn off Windows Messenger as described here: http://www.microsoft.com/windowsxp/using/security/learnmore/stopspam.mspx