1 |
Hi Grant, |
2 |
|
3 |
personally (but this is by far only ONE possible setup for your task) |
4 |
I'd advise you to connect eth0 to wan through a box set up as a bridge |
5 |
(try brctl). If that box has a good wireless card and good drivers (this |
6 |
mostly means "if that box isn't running Windows") you can also put that |
7 |
wireless-card into promiscuous mode lock it to your chanel and ssid and |
8 |
feed wireshark your WEP-Key or WPA-PSK for decryption. |
9 |
If not, then you'll have to use a second box for the wireless sniffing. |
10 |
|
11 |
BTW. current rootkits won't just replace ps or some other tools. Good |
12 |
rootkits do not run in userspace; they run in kernelspace. They directly |
13 |
intercept the function-calls. Just another thing to keep in mind while |
14 |
trying to scan for them. |
15 |
|
16 |
hth |
17 |
Paul |
18 |
|
19 |
Grant schrieb: |
20 |
>> > A good rootkit will install a "ps" that won't show the 'bot |
21 |
>> > processes. The one time a machine of mine got hacked, netstat |
22 |
>> > still worked, but I don't know why a hacked netstat couldn't be |
23 |
>> > installed as well. |
24 |
>> |
25 |
>> > Looking through /proc/˜pid> is probably still reliable. |
26 |
>> |
27 |
>> |
28 |
>> Hello Grant, |
29 |
>> |
30 |
>> I keep an old portable around, running wireshark and a flat hub. |
31 |
>> You can set your ethernet address to 0.0.0.0 and fire up wireshark. |
32 |
>> |
33 |
>> You can then sniff any (ethernet) segment of your network for |
34 |
>> nefarious traffic or male-configured network applictions. |
35 |
> |
36 |
> Ok, it sounds like the key to figuring this out is watching the |
37 |
> outgoing network traffic for weird stuff. eth0 is on the WAN and |
38 |
> wireless ath0 is on the local subnet. How would you monitor the |
39 |
> outgoing traffic considering my setup? |
40 |
> |
41 |
> - Grant |
42 |
> éí¢‹¬z¸žÚ(¢¸&j)bž bst== |
43 |
|
44 |
-- |
45 |
gentoo-user@g.o mailing list |