1 |
On Sun, 11 Feb 2007 19:58:49 -0800 |
2 |
Grant <emailgrant@×××××.com> wrote: |
3 |
|
4 |
> > > A good rootkit will install a "ps" that won't show the 'bot |
5 |
> > > processes. The one time a machine of mine got hacked, netstat |
6 |
> > > still worked, but I don't know why a hacked netstat couldn't be |
7 |
> > > installed as well. |
8 |
> > |
9 |
> > > Looking through /proc/≤pid> is probably still reliable. |
10 |
> > |
11 |
> > |
12 |
> > Hello Grant, |
13 |
> > |
14 |
> > I keep an old portable around, running wireshark and a flat hub. |
15 |
> > You can set your ethernet address to 0.0.0.0 and fire up wireshark. |
16 |
> > |
17 |
> > You can then sniff any (ethernet) segment of your network for |
18 |
> > nefarious traffic or male-configured network applictions. |
19 |
> > |
20 |
> > hth, |
21 |
> > |
22 |
> > James |
23 |
> |
24 |
> I can see in an xfce4 panel plugin that there is constantly a small |
25 |
> amount of incoming/outgoing traffic to/from the affected system when |
26 |
> there is no reason I know of for it. netstat doesn't show anything |
27 |
> that jumps out at me although this is the first time I've really used |
28 |
> it. All of the current netstat connections appear to be UNIX as |
29 |
> opposed to Internet. Should I paste them in? |
30 |
> |
31 |
> - Grant |
32 |
> [Error decoding BASE64] |
33 |
nope, they're all local socket connections. What kind of traffic are |
34 |
you seeing, i mean how much? Ever heard of tcpdump? |
35 |
-- |
36 |
gentoo-user@g.o mailing list |