Windows Software for Controlling Outgoing Packets?

non carborundum asks: "When using Windows I use Zonealarm because I like its ability to control outgoing packets. It's a good way to find out if some program is trying to call home. Zonealarm is much better than nothing, but 1 prefer open source solutions. Besides, it is overkill - I don't use it as a firewall, since I have a router, and it uses several megabytes of RAM. Better still would be a reverse honeypot - an app that catches outgoing requests, tests them against a database of known offending addresses and/or ports, and (optionally) tricks the offending application into thinking it has successfully phoned home. XP users in particular might be interested in such a tool."

Comments

Try Tiny Personal Firewall.

[Conspiracy FACT]

TPF is great packet sniffing software. It allows you to determine which apps are allowed to receive incoming TCP connections, or make outgoing TCP connections, or receive incoming UDP connections... and which ones aren't. It also allows you to stop Net BIOS name resolution as well as other neat stuff. It gives you much more control then Zone Alarm does. Really a great piece of software.

TPF used to be freeware. You can pick up the shareware version here. You can still find the old freeware version (which I use) here.

For the record, I use both Zone Alarm and Tiny Personal Firewall.

Re:Try Tiny Personal Firewall.

[alfaiomega]

Better still would be a reverse honeypot - an app that catches outgoing requests, tests them against a database of known offending addresses and/or ports, and (optionally) tricks the offending application into thinking it has successfully phoned home.

For something like this you need not a firewall but an IDS, an Intrusion Detection System, with correct signatures of traffic you want to detect. I would suggest Snort (there's an MS Windows port), a great free software IDS released under the GPL 2+. It won't change the traffic, but it will detect it (you have to use signatures matching traffic patterns of known spyware or even something very general, but disable Web attacks rules and other which you don't need to look for).

To fool application you would need not only some firewall/router rules to redirect the traffic somewhere else, like to your own machine, but you would also need this machine to speak the right protocol, which may be much harder than useful, or even impossible without altering the spyware binaries. I would personally rather not use spyware at all instead of mounting such attacks against their communication. If I wanted to write spyware, I'd use valid HTTP on port 80 to call home, which wouldn't differ from normal WWW traffic, or ICMP ECHO_REQUEST/ECHO_RESPONSE, etc. The problem is that if you have any network connection at all, the covert channels will always be possible.

But if you really want to try intercepting and altering the spyware traffic, which may be fun after all, you may want to take a look at such tools as ngrep, tcpdump, netsed, netcat, etc. If you want to look for open ports on your machine, use nmap. Use Nessus if you want to test for many different vulnerabilities.

These packages make your windows instable

[synq]

I used to use e-safe and I've also used ZoneAlarm but with both these packages I experienced huge system instability over some time. The same goes for Cisco VPN software. It seems to me that anything you do to the Microsoft TCP stack makes it more instable. Guess that stack is 'part of the system that cannot be replaced' as of Windows XP?

Kerio Personal Firewall

[Lawrence Ho]

Kerio Personal Firewall

It's simple and gets the job done. Rules can be set to allow or block incoming and outgoing TCP/UDP traffic. It verifies the MD5 of the applications. Also eats several megabytes of RAM though...

The best article on the subject

[phaze3000]

http://www.samspade.org/d/firewalls.html I agree with pretty much everything the article says..

Sygate

[Apreche]

It's not free, or open, but Sygate's professional firewall is awesome. Much better than ZoneAlarm. There is a free personal version of the software, but it lacks the features that make the professional one so awesome. However, I would reccomend the personal one over ZoneAlarm. Try sygate, It can do almost anything you can think of.

Re:Router?

[OrangeSpyderMan]

With one notable difference - a router routes and a switch only switches. :-)

Seriously though, btw IANANG (Network Guy), a proper router will be capable of far more than a layer 3 switch will. A switch will only "see" what is directly connected to it, a router, once it does more than just route between a local network and "the rest of the world" is going to need a few clues not only about its own gateways, but also its gateway's gateways and so on.

I once read somewhere on the net "90% of all network problems are routing problems. Of the 10 remaining, 9 are routing problems, in the other direction and the other 1% are not routing related, but check the routing just in case." Says it all, really! :-)

ZoneAlarm and VisualZone are good.

[Futurepower(R)]

It seems to me that, if you are using Windows XP and a hardware firewall, it is better to use the ZoneAlarm software firewall. Then you can run VisualZone, and quickly see whether anything has gotten through your hardware firewall. Don't worry about ZoneAlarm's RAM use. RAM is cheap.

ZoneAlarm works well with Windows XP. It is necessary to disable Microsoft's firewall, of course; you don't want the wolf to guard the henhouse. (See the section Windows XP connects to Microsoft's computers in at least 17 ways. in the article, Windows XP Shows the Direction Microsoft is Going..)

A lot of us need to run programs that don't have Linux or BSD versions. For us, Microsoft has an absolute monopoly. It's hopeless being involved in adversarial behavior with Microsoft. The company has $40 billion cash in the bank. I have ... (Looks in billfold... Moth flies out.)

One way to cope with the situation is to use two computers connected to one keyboard, mouse and monitor. Run Mozilla on Linux on a computer that is connected to the Internet. Disable internet access on the other computer running Windows XP by removing the TCP/IP protocol. Use another protocol, such as NETBEUI, for file sharing. (IOGear seems to make the best KVM switch. My experience has been that there is no video degradation with IOGear KVMs.)

My experience, and the experience of others, is that Windows XP doesn't crash, it just becomes less usable. Windows XP becomes shaky when enough programs are loaded that all of the installed memory is in use. There are other situations where Windows XP begins malfunctioning, but these are not well characterized. (Can anyone help me here?) The symptoms of the malfunction are slowness to respond to the keyboard, and disk thrashing caused by virtual memory use that sometimes takes 45 seconds or more.

The consensus seems to be, however, that Windows XP is Microsoft's best OS. The only other candidate is Windows 2000. Any comments?

The single biggest cause of instability in a system that was once stable is bad connections. Just open up the case, pull out all connectors and adapter cards a few millimeters, and push them back. That cleans the contacts.

(Download ZoneAlarm FREE for personal use.)

Ad-Aware is excellent for use with Windows XP. It gives a list of all running processes, who made the software, and where it is located on the hard drive. It's main purpose is to check for spyware. (Virus program software does not check for spyware, so you need a separate program.)

In Portland, Oregon, USA, the best Internet connection is Hevanet DSL with a Cisco 675 router from the phone company, Qwest. The Cisco 675 can be put into mode in which it is a true hardware firewall, not just a NAT device. (My only connection with Hevanet is as a satisfied customer.)