If what goes out has strange patterns, your network may already have been compromised. Look particularly for File Transfer Protocol transmissions that do not match any external requests. Check for use of Linux tools such as nMap 2.02, which identifies operating systems and services on networked computers. If you see User Datagram Protocol traffic, it might be identifying the open ports even if they don't answer. The nMap reconnaissance tool builds flat-file databases about your network.
Hackers then query the databases about specific machines so they can target known vulnerabilities.
You will help every government site by finding and closing your own site's holes. Also, experts at the SANS Institute think the popular PKZip shareware file-decompression utility could be a security risk because it supports the TimeSink AdGateway for display of ad banners and allows uncontrolled outbound FTP connections. Knowing that your network is being mapped is the first step in stopping intruders. Shawn P. McCarthy designs search and navigation products for a Web search engine provider. All rights reserved.