A method of operating an external network monitoring system for detecting malware in a network device of a network, the method comprising the steps of:
- receiving copies of network traffic information at a network monitor server corresponding to LAN side network traffic comprising LAN side entering packets and LAN side exiting packets of a monitored network device, said LAN side entering and exiting packets being received at the monitored network device from a first network tap comprising LAN side network traffic transmitted to and from the monitored network device,
- detecting a LAN side exiting packet which does not have a corresponding LAN side entering request for data,
- extracting a packet header information portion from said received LAN side entering and exiting network packets at said network monitor server, receiving copies of network traffic information at said network monitor server corresponding to network traffic comprising entering packets and exiting packets of the monitored network device, said packets being received at the monitored network device from a first network tap comprising WAN side network traffic transmitted to and from the monitored network device, comprising entering WAN side network packets and said packets further being received at the monitored network device from said first network tap comprising WAN side exiting network packets transmitted to and from the monitored network device,
- extracting a packet header information portion from said received LAN side entering network packets and said received LAN side exiting network packets at said network monitor server,
- determining matching packets based on a comparison of the extracted header information portions of the LAN side network traffic and the WAN side network traffic, said determination comprising:
- comparing at least one source IP element from an extracted packet header information portion of a LAN side exiting network packet with at least one source IP element from an extracted packet header information portion of a corresponding WAN side entering network packet, and
- comparing at least one source port element from an extracted packet header information portion of a LAN side exiting network packet with at least one source port element from an extracted packet header information portion of a corresponding WAN side entering network packet, and
- comparing at least one destination IP address element from an extracted packet header information portion of a LAN side exiting network packet with at least one destination IP address element from an extracted packet header information portion of a corresponding WAN side entering network packet, and
- comparing at least one destination port element from an extracted packet header information portion of a LAN side exiting network packet with at least one destination port element from an extracted packet header information portion of a corresponding WAN side entering network packet, and
- comparing at least one source IP element from an extracted packet header information portion of a WAN side exiting network packet with at least one source IP element from an extracted packet header information portion of a corresponding LAN side entering network packet, and
- comparing at least one source port element from an extracted packet header information portion of a WAN side exiting network packet with at least one source port element from an extracted packet header information portion of a corresponding LAN side entering network packet, and
- comparing at least one destination IP address element from an extracted packet header information portion of a WAN side exiting network packet with at least one destination IP address element from an extracted packet header information portion of a corresponding LAN side entering network packet, and
- comparing at least one destination port element from an extracted packet header information portion of a WAN side exiting network packet with at least one destination port element from an extracted packet header information portion of a corresponding LAN side entering network packet, and
- generating an alert when no matching WAN side entering packet is found for a corresponding LAN side exiting packet or no matching LAN side entering packet is found for a corresponding WAN side exiting packet based on at least one of said comparisons.
- wherein the first network tap is directly coupled to a WAN side of the monitored network device comprising three bidirectional ports including:
- a first input port for receiving WAN side incoming network traffic,
- a first output port co-located with the first input port for forwarding the incoming WAN side network traffic directly to the monitored network device as outgoing network traffic, and
- a first monitoring port co-located with the first input port and the first output port for forwarding a copy of the incoming WAN side network traffic and the outgoing network traffic to a first network monitor server,
- wherein the first network tap is configured to copy all incoming and outgoing network traffic data being communicated on the WAN side of said network device in said network in a coupled state;
- the second network tap directly coupled to a LAN side of a monitored network device in said network, the first network tap comprising three bidirectional ports including:
- an input port for receiving LAN side incoming network traffic,
- an output port for forwarding the incoming LAN side network traffic directly to the monitored network device as outgoing network traffic, and
- a monitoring port for forwarding a copy of the incoming LAN side network traffic and the outgoing network traffic to the first network monitor server,
- wherein the second network tap is configured to copy all of said incoming and outgoing network traffic data being communicated on said LAN side of said network device in said network in said coupled state, and
- wherein the first network monitor server is coupled in series and parallel with said monitored network device, the server being in operable communication with the first network tap and the second network tap,
- wherein said parallel coupling between the first network monitor server and said monitored network device comprises a first coupling means configured to couple the network monitor server directly to the monitored network device via the first network tap on said WAN side of the network device and a second coupling means configured to couple the network monitor server directly to the monitored network device via the second network tap on said LAN side of the network device.