Monitoring connections to a network drive

tvout · 17-12-2011, 14:47

Hi all,

I posted a similar one to this a while back but wondering if anyone can help with this as I have a new router which isn't quite as technical as the last one.
I have a netdisk network drive connected to my router which allows FTP access with username/password control.
If I leave the FTP port open on my router I tend to hear activity noises on the drive to suggest attempted external access probably following a port scan.
I tried setting the port to be different to the default 21 but my new router doesn't allow for the inbound port on the router to a different internal port as my old router did.
I was thinking about something like netstat but really want something I can run on my laptop which somehow can see inbound and outbound connections on the drive. I'm thinking the only way of doing something like that would need the drive itself to be running some kind of app but it's a unix type firmware on the landisk which doesn't seem to allow for anything like that to run.
My other thoughts are alternative firmware for the drive which I'm a bit cautious about and would involve probably formatting the disk and copying everything back again.
It's a very reliable drive I would just want to ensure as best security as possible really, it would be great to have always on access to it from outside my network without worrying about the data on there being hacked...

Many thanks

Graham M · 17-12-2011, 17:22

It is unlikely that a port scan would cause the hard disk to make any noises as unless there is some sort of log stored on the drive, there is no reason that it would be accessed until someone actually managed to break in, it could well be a file indexing process or similar.

tvout · 17-12-2011, 17:27

Hi Graham M, it used to make odd noises when I had port 21 open all the time. I could hear the hard drive doing something, it's normally quiet on power save mode. You can hear it when it spins up and sounds like it was doing something even though I wasn't accessing it myself in the house. With the port blocked it doesn't make that noise at all. I try and make the user names and passwords quite secure but I worry they can still be hacked.

Graham M · 17-12-2011, 17:28

Is there no sort of security log on the drive?

tvout · 17-12-2011, 18:29

Nothing I can find, it's quite a basic menu, no logs or anything. Just things like time/date/disk check and smb and ftp security and set up.

Uncle Peter · 17-12-2011, 23:21

or it could be just broadcast traffic hitting the stack on the drive's OS. Chuck the drive on a hub and sniff the port if you're that worried about it.

tvout · 18-12-2011, 00:23

Quote:

Originally Posted by Uncle Peter

or it could be just broadcast traffic hitting the stack on the drive's OS. Chuck the drive on a hub and sniff the port if you're that worried about it.

Cool, cheers. How easy would it be to do that? I do have a hub that's connected to my router I could connect it to but my laptop is connected wirelessly so not sure how best to do it. The hub is a netgear 1gb/s one, the network drive is plugged directly into the router.

Uncle Peter · 18-12-2011, 00:48

Probably not so easy with a Windows machine these days as our friends at Microsoft started locking the Windows networking components down in XP to prevent promiscuous captures and I expect the case is the same with Windows Vista/7/2K8. I have an old laptop running Redhat and an ancient distro of Ethereal which works just fine with it's internal NIC.

Just make sure your hub is actually a hub and not a switch if you want to go down this route

Just a quick footnote: This is where your dd-wrt comes in handy, you'll have more diagnostic tools in the little box than you can shake a stick at. I used to have a cracking d-link router (non dd-wrt) which had a connection status dialog for the wan port in the gui, I expect this is what you had before. Alas, useful functions like this seem to be disappearing unfortunately.