From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists.gentoo.org ([140.105.134.102] helo=robin.gentoo.org) by nuthatch.gentoo.org with esmtp (Exim 4.62) (envelope-from ) id 1HGdFh-000490-TZ for garchives@archives.gentoo.org; Mon, 12 Feb 2007 15:38:03 +0000 Received: from robin.gentoo.org (localhost [127.0.0.1]) by robin.gentoo.org (8.14.0/8.14.0) with SMTP id l1CFan47030345; Mon, 12 Feb 2007 15:36:49 GMT Received: from mail (c-24-245-14-14.hsd1.mn.comcast.net [24.245.14.14]) by robin.gentoo.org (8.14.0/8.14.0) with ESMTP id l1CFWoHv025793 for ; Mon, 12 Feb 2007 15:32:51 GMT Received: from pascal.spore.ath.cx (pascal.spore.ath.cx [192.168.1.100]) by mail (Postfix) with ESMTP id 736353CF2 for ; Mon, 12 Feb 2007 09:32:49 -0600 (CST) Date: Mon, 12 Feb 2007 09:32:47 -0600 From: Dan Farrell To: gentoo-user@lists.gentoo.org Subject: Re: [gentoo-user] Re: Did I just get hacked??? Message-ID: <20070212093247.4278812c@pascal.spore.ath.cx> In-Reply-To: <49bf44f10702111958i4624e0den3d76c0db7d2a5dde@mail.gmail.com> References: <49bf44f10702101827k199bf270yfb65ed1f4f5195e0@mail.gmail.com> <1171165124.381.9.camel@blackwidow.nbk> <8d634f4f0702102006w78f419acp14ddc64a8652693d@mail.gmail.com> <49bf44f10702111958i4624e0den3d76c0db7d2a5dde@mail.gmail.com> Organization: Spore, Ltd. X-Mailer: Sylpheed-Claws 2.4.0 (GTK+ 2.10.6; x86_64-pc-linux-gnu) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@gentoo.org Reply-to: gentoo-user@lists.gentoo.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Archives-Salt: 53f270e4-c69d-4cf5-88f3-12241b8ea3b0 X-Archives-Hash: 023719e1bb26a7ad2271cbd60b5aa12f On Sun, 11 Feb 2007 19:58:49 -0800 Grant wrote: > > > A good rootkit will install a "ps" that won't show the 'bot > > > processes. The one time a machine of mine got hacked, netstat > > > still worked, but I don't know why a hacked netstat couldn't be > > > installed as well. > > > > > Looking through /proc/=E2=89=A4pid> is probably still reliable. > > > > > > Hello Grant, > > > > I keep an old portable around, running wireshark and a flat hub. > > You can set your ethernet address to 0.0.0.0 and fire up wireshark. > > > > You can then sniff any (ethernet) segment of your network for > > nefarious traffic or male-configured network applictions. > > > > hth, > > > > James >=20 > I can see in an xfce4 panel plugin that there is constantly a small > amount of incoming/outgoing traffic to/from the affected system when > there is no reason I know of for it. netstat doesn't show anything > that jumps out at me although this is the first time I've really used > it. All of the current netstat connections appear to be UNIX as > opposed to Internet. Should I paste them in? >=20 > - Grant > [Error decoding BASE64] nope, they're all local socket connections. What kind of traffic are you seeing, i mean how much? Ever heard of tcpdump? =20 -- gentoo-user@gentoo.org mailing list