How to Know Who Is Invading Your Laptop

Malicious computer attacks are usually performed by automated software rather than a live person.

You can inspect open network connections on your laptop when you suspect that someone is invading the computer over the network. Dynamic IP addressing and Network Address Translation can make it difficult to identify the culprit however standard network utilities can help. Use the Windows 7 Netstat and Nbtstat command line tools to find information on a computer used to maliciously access your laptop.

Things You'll Need

• Microsoft Windows 7 computer

Instructions

1. Click the Windows orb located on the Windows desktop task bar. Type “cmd” in the “Search” box. Right-click on the command line icon that appears and click “Run as Administrator.”

2. Type “netstat –ab | more” on the command line and press “Enter.” For each line where Established is listed in the State column, note the IP address or host name listed under the Foreign Address column.

3. Open a Web browser such as Internet Explorer. Click the address bar near the top of the web browser window. Type the “IP-Lookup” website URL (IP-Lookup.net) into the address bar and press “Enter.”

4. Type a host name or IP address noted previously into the “Lookup an IP address” field and press “Enter.” Note the owner information listed in the Web page. This information provides you with the name of a company or Internet Service Provider that owns the IP address. Repeat this step for each IP address or host name noted earlier, and exclude the results identified as services you use on the Internet.

5. Enter the “IP Address Locator” website URL (ip-address.org) into the address bar near the top of the web browser window. Press the “Enter” key. Type an IP address or host name from the list of addresses not associated with your Internet services into the “Start to Trace IP Location with IP Locator” text box. Press the “Enter” key. Repeat this step for each IP address or host name for the list of addresses not associated with your Internet services.

6. View the results displayed in the Web page for each IP address or host name. Note the IP address location and owner information. Note any one you know that is located in the same area as the IP address location or that works at the same company as the IP address owner. If the IP address information displays “unknown” for all fields listed, the address is on your local network.

7. Type “nbtstat –a IP_Address” on the command line except replace “IP_Address” with one of the IP addresses for which all fields displayed “unknown” in the previous step. For each IP address that does not display a “Host not found” result in the command line output, note the computer name and MAC address displayed. Contact the local network administrator to determine who uses the computers identified in the Nbtstat output.

Tips & Warnings

• Note that your laptop may be invaded by automated malicious software or an attacker whose location is masked by a series of Internet proxies.

References

• Computer Hope: Microsoft DOS Netstat Command Help
• Source Daddy: Netstat
• Source Daddy: Nbtstat

Resources

• IP-Lookup: Lookup
• IP-Address Locator: IP-Address