How to monitor, detect suspicious traffic?

Question

Computer networks

The office has about 80 computers, the departments are divided into vilans. Most computers have 10, but there are old laptops with 7 more. A normal antivirus is rare. This week the ISP blocked our office IP twice due to suspicious traffic.

After talking with those support, they told me which ports were active. I started "sniffing" the network with tcpdamp'om And indeed I found an infected laptop from which requests are constantly sent to the Internet for ports 22, 8728 and 8291 for different APIs.

The whole office goes to the Internet through a gateway - a regular server with FreeBSD 11.4 On a fryahe as a firewall - Packet Filter (PF)

Tell me how you can monitor, detect such traffic? And how do you keep track of it?

Answer 1

Snort
Suricata

Answer 2

EDR class solutions