Cause of network malfunction are varied. We will introduce a common network malfunction to be generated by malware.
Once we meet the network malfunction or attack, we should view the currently total network traffic, sent/received traffic, network connection etc, according to this information, we can confirm that if there are Broadcast / multicast storm, and help users detecting the network malfunctions about network slow, network disconnect, worm attack, DOS attack, and all the malfunctions besides. The nodes tab has been figured below (Figure 1):
Figure 1: the nodes tab shows the first IP address with the biggest traffic is abnormal
In figure 1, we can make a compositor on the total traffic, to view network connection and other related information relate to the IP address, we will find and locate the host with largest traffic or most connections in the network. For example, at present, the host with the largest network connection is , we can locate the host, then check the related connection information (figure 2):
Figure 2: the TCP Conversation tab shows the IP tried to initiate connections with remote addresses
The connection information shown as the figure 2, we can know that has set up a large amount of TCP connection with other hosts, and the destination address and destination address are indefinite, and many of the state is to connect client requests synchronization. Next, check the TCP packets, we can check them out in the Summary tab as figure 3 below:
From TCP statistical data on the Summary view, we can know that there are lots of TCP Connections initiated, but TCP connections established are so few, and this is deviant in the network.