Re: [gentoo-user] Re: Did I just get hacked???

["nicolas.cornu" <nicolas.cornu@ch-st-julien.fr>]

Grant wrote:

>> > > > A good rootkit will install a "ps" that won't show the 'bot
>> > > > processes. The one time a machine of mine got hacked, netstat
>> > > > still worked, but I don't know why a hacked netstat couldn't be
>> > > > installed as well.
>> > >
>> > > > Looking through /proc/≤pid> is probably still reliable.
>> > >
>> > >
>> > > Hello Grant,
>> > >
>> > > I keep an old portable around, running wireshark and a flat hub.
>> > > You can set your ethernet address to 0.0.0.0 and fire up wireshark.
>> > >
>> > > You can then sniff any (ethernet) segment of your network for
>> > > nefarious traffic or male-configured network applictions.
>> > >
>> > > hth,
>> > >
>> > > James
>> >
>> > I can see in an xfce4 panel plugin that there is constantly a small
>> > amount of incoming/outgoing traffic to/from the affected system when
>> > there is no reason I know of for it. netstat doesn't show anything
>> > that jumps out at me although this is the first time I've really used
>> > it. All of the current netstat connections appear to be UNIX as
>> > opposed to Internet. Should I paste them in?
>> >
>> > - Grant
>> > [Error decoding BASE64]
>> nope, they're all local socket connections. What kind of traffic are
>> you seeing, i mean how much? Ever heard of tcpdump?
>
>
> I just did a fresh reboot and as soon as xfce4 was loaded I was seeing
> between .2kbps and .6kbps incoming and outgoing traffic constantly in
> the xfce4 panel plugin which uses /proc/net/dev. I then changed the
> WPA wireless password on the router so the machine couldn't connect
> and the panel plugin started reporting small bursts of
> incoming/outgoing traffic instead of the constant stream. I then
> updated the machine's password to match the router's new password and
> the steady stream returned.
>
> netstat --ip reports absolutely no connections during all of this.
>
> Should I emerge tcpdump and run that?
>
> - Grant
> │ИМ╒▀╛z╦\x1e·з(╒╦&j)b· b
> st==

Hi,

You could try wireshark which is almost the same thing as tcpdump but
graphical. it will help you to analyze the packets going through your
interface.


-- 
gentoo-user@gentoo.org mailing list