Monitor network activity.

[sponge_b0b]

Hello people,

I would like to stop my machine (windows 8.1) to send data without my consent / without being aware.

So I installed NetworkTrafficView from Nirsoft and use also the windows embedded Resource monitor.

So there are some applications/activity easy to spot and shut.

But for instance in Network Traffic view I see this :

so i see that my machine launch a Multicast for the llmnr, but what is "funny" in the columns Process Filename of NetworkTrafficView I see nothing :/ so which application/service to shut ?

Did you know a good way to block all traffic by default and be asked every time that a new traffic as been discovered to allow it or block one by one ? thank you !

 

[ss202sl]

https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution

 

[sponge_b0b]

https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution

Thank but I know what is LLMNR and I shut it trough the firewall. But I mean is there an easy solution to render a winodws more silent ?

Did you know another alternative to NetworkTrafficView from Nirsoft ? because he don't have filter option

 

[bill001g]

Your problem is the OS itself can bypass the firewall settings. I tried to prevent windows 10 from sending crap to microsoft and even if I block all traffic completely it still sends it.

Multicast is not really supported on the internet. In addition that special kind of multicast will never leave the lan segment even on routers that fully support multicast. It basically is just some garbage traffic. If you really wanted to stop it I suspect it might be a setting on the nic.

In your case it doesn't matter a lot because the traffic never leaves your house but if you need to block something that was going to the internet you could block it on many routers. To block traffic on a lan you would need a special switch that has the ability to filter traffic.

 

[failboat]

Pfsense router/switch with snort.

What you want to do will be time consuming unless you only plan to use the computer for only a few specific tasks.

If you plan on browsing the internet you will be unblocking ips the entire time you use it.
A lot of traffic is encrypted so it won't even know what the packets are. All you can do for those is whitelist ips and large sites have loads of ips or let all the encrypted stuff through. There are some community lists you can sub to and make the manual process a little easier.

Snort is constantly updated to detect malicious network activity and it can turn the network off to an infected PC.