[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: security issue help



On 9/13/06, Jacques B. <jjrboucher gmail com> wrote:
Do a netstat -an to see what ports are listening.  Typical IRC traffic
is TCP ports 6667, 6668, 6669.  If you see listening on one of those
ports yet are not running IRC, good indicator.  Botnets can run on
alternate ports in the meantime so even if you don't see listening on
those ports, it doesn't mean you are in the clean.  You can also check
running processes (ps - aux) to look for any suspicious processes.
The top command can also be of assistance in seeing what processes are
running.  ntop (see http://www.ntop.org/) is another tool you could
use to examine network traffic.  And running wireshark (formerly
ethereal) to capture traffic to attempt to identify suspicious network
activity.  You can install wireshare from extras I believe, as well as
wireshark-gnome (actually if you yum install wireshark-gnome,
wireshark should get installed as a dependancy).

Of course the check rootkit tool is another one that can be very helpful.

Good luck,

Jacques B.



Before people jump on my for top posting on that last one, it was not intended.

You can also try checking your arp table using the arp command.  That
would show you IPs & MAC address (arp = address resolution protocol)
that would normally only get populated if your system connected to
that IP (arp poisoning could populate it also).

Jacques B.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]