Intrusion detection in a small home network
The number of devices in my home network keeps growing: Apart from my gaming PC and our home office notebooks, we have the kids' tablets, all our smart phones, a smart TV stick, some WLAN peripherals, etc. The more devices we get, the more I start to worry about one of them being compromised. An adversary could use some "unimportant" device (e.g. an old tablet or printer) for lateral movement across the (W)LAN to attack "important" devices (e.g. one of the PCs).
Thus, I'd like to somehow get informed when a device tries to do something fishy. At work, I use a dedicated hardware firewall for this purpose: Its intrusion detection system will inform me as soon as any device tries to, for example, contact a well-known Command and Control server.
Yet somehow I'm hesitant to purchase/set up a business-grade firewall/IDS system for a private home network---it feels like an over-reaction. Is there some simpler solution that will give me some kind of intrusion detection? One option that comes to my mind would be a software running on one of the PCs that watches for incoming port scans, but I'm open to any other kind of suggestion as well. My main goal would be to identify compromised devices inside the home network so that I can remove them from the network.
