Search

.518025 pkts=2 kpps=0.0 kbytes=0 mbps=0.0 nic_pkts=2 nic_drops=0 u=0 t=0 i=0 o=0 nonip=2 1415510238.518111 pkts=8 kpps=0.0 kbytes=1 mbps=0.0 nic_pkts=10 nic_drops=0 u=5 t=2 i=0 o=0 nonip=1 1415510241

Combined Search # ausearch -k hosts-file -ts today -ul 1000 ---- time->Tue Jul 1 16:36:00 2014 type=PATH msg=audit(1404225360.791:124138): item=0 name="/etc/hosts" inode=2755966 dev=fd:02 mode=0100644

TIME CMD Root 1 0 0 19:05 ? 00:00:00 sleep 1000 Listing 2 Process on the Host $ ps -ef|grep sleep Cherf 30328 29757 0 20:44 ? 00:00:00 sleep 1000 Cherf 30396 3353

,BROADCAST,RUNNING,MULTICAST> mtu 1460 inet 10.0.0.2 netmask 255.255.255.255 broadcast 0.0.0.0 inet6 fe80::bfd3:1a4b:f76b:872a prefixlen 64 scopeid 0x20 ether 42:01:0a:80:00:02 txqueuelen 1000

.255.255.255  broadcast 0.0.0.0         inet6 fe80::bfd3:1a4b:f76b:872a  prefixlen 64  scopeid 0x20         ether 42:01:0a:80:00:02  txqueuelen 1000  (Ethernet)         RX packets 11919  bytes 61663030 (58.8 Mi

[...]$ The new system call setsockopt() can also be traced using analysis tools such as strace: $ grep setsockopt tcp_stealth_server.strace 29392 setsockopt(3, SOL_TCP, 0x1a /* TCP_??? */, "This is mymagic ... Port scans for finding vulnerable services are nothing new, and port knocking as a defense has been around for a while, too. TCP Stealth tries to do something similar, but it takes a more ... TCP Stealth ... TCP Stealth hides open ports ... TCP Camouflage

-fastcgi are running, as expected. Listing 1 Process List root 589 0.0 0.3 142492 3092 ? Ss 20:35 0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on; www

-gmond-modules-python-3.6.0-1.x86_64.rpm http://vuksan.com/centos/RPMS-6/x86_64/libganglia-3.6.0-1.x86_64.rpmhttp://vuksan.com/centos/RPMS-6/x86_64/ganglia-gmond-3.6.0-1.x86_64.rpm Retrieving http

:     0.0%  CPU2    user:      0.0%  nice:    0.0%    system:    0.0%  idle:  100.0%    iowait:    0.0%  irq:     0.0%    softirq:   0.0%  steal:   0.0%    guest:     0.0%  CPU3    user:      0.0%  nice

can see how the arp cache poisoning works: $ sudo nemesis arp -v -r -d eth0 -S 192.168.1.2 \ -D 192.168.1.133 -h 00:22:6E:71:04:BB -m 00:0C:29:B2:78:9E \ -H 00:22:6E:71:04:BB -M 00:0C:29:B2:78:9E