| 1 |
> > A good rootkit will install a "ps" that won't show the 'bot |
| 2 |
> > processes. The one time a machine of mine got hacked, netstat |
| 3 |
> > still worked, but I don't know why a hacked netstat couldn't be |
| 4 |
> > installed as well. |
| 5 |
> |
| 6 |
> > Looking through /proc/˜pid> is probably still reliable. |
| 7 |
> |
| 8 |
> |
| 9 |
> Hello Grant, |
| 10 |
> |
| 11 |
> I keep an old portable around, running wireshark and a flat hub. |
| 12 |
> You can set your ethernet address to 0.0.0.0 and fire up wireshark. |
| 13 |
> |
| 14 |
> You can then sniff any (ethernet) segment of your network for |
| 15 |
> nefarious traffic or male-configured network applictions. |
| 16 |
|
| 17 |
Ok, it sounds like the key to figuring this out is watching the |
| 18 |
outgoing network traffic for weird stuff. eth0 is on the WAN and |
| 19 |
wireless ath0 is on the local subnet. How would you monitor the |
| 20 |
outgoing traffic considering my setup? |
| 21 |
|
| 22 |
- Grant |
Archives