Re: [gentoo-user] Re: Did I just get hacked???

[Grant <emailgrant@gmail.com>]

> > > > A good rootkit will install a "ps" that won't show the 'bot
> > > > processes.  The one time a machine of mine got hacked, netstat
> > > > still worked, but I don't know why a hacked netstat couldn't be
> > > > installed as well.
> > >
> > > > Looking through /proc/≤pid> is probably still reliable.
> > >
> > >
> > > Hello Grant,
> > >
> > > I keep an old portable around, running wireshark and a flat hub.
> > > You can set your ethernet address to 0.0.0.0 and fire up wireshark.
> > >
> > > You can then sniff any (ethernet) segment of your network for
> > > nefarious traffic or male-configured network applictions.
> > >
> > > hth,
> > >
> > > James
> >
> > I can see in an xfce4 panel plugin that there is constantly a small
> > amount of incoming/outgoing traffic to/from the affected system when
> > there is no reason I know of for it.  netstat doesn't show anything
> > that jumps out at me although this is the first time I've really used
> > it.  All of the current netstat connections appear to be UNIX as
> > opposed to Internet.  Should I paste them in?
> >
> > - Grant
> > [Error decoding BASE64]
> nope, they're all local socket connections.  What kind of traffic are
> you seeing, i mean how much?  Ever heard of tcpdump?

I just did a fresh reboot and as soon as xfce4 was loaded I was seeing
between .2kbps and .6kbps incoming and outgoing traffic constantly in
the xfce4 panel plugin which uses /proc/net/dev.  I then changed the
WPA wireless password on the router so the machine couldn't connect
and the panel plugin started reporting small bursts of
incoming/outgoing traffic instead of the constant stream.  I then
updated the machine's password to match the router's new password and
the steady stream returned.

netstat --ip reports absolutely no connections during all of this.

Should I emerge tcpdump and run that?

- Grant