Networking :: Network Security - How To Identify Programs And Processes

Sep 2, 2010

I was wondering if anyone might know of good reference material, books websites etc., that discuss network security issues in layman terms. I would like to set up a dedicated Linux box as a firewall and would like to have a deeper understanding of the different types of configurations that are possible. I run a dual boot system and most of the firewalls I have used on the Windows side are very confusing to me. A lot of the time they give you a pop up that informs you that some cryptically named program is trying to access the network or the internet and wants to know if I want it to or not, 99% of the time I have not idea if it is a legitimate program or not. I realize that this is probably a separate issue (knowing how to identify programs and processes that should have access from those that should not) from setting up a firewall and basic network security but I know that they are related.

View 3 Replies


ADVERTISEMENT

Server :: Identify Which Processes Are Consuming Swap?

Jul 19, 2011

How to identify which processes (or PIDs) are consuming SWAP? In my RHEL box SWAP is nearly 100 % utilized.

Code:
$ free -m
total used free shared buffers cached
Mem: 144967 143212 1754 0 166 135259
-/+ buffers/cache: 7787 137180
Swap: 22367 21733 634

View 11 Replies View Related

Security :: Controlling External Network Access Per Processes?

Aug 13, 2010

That would seem like an elementary feature to be able to enable only a few system applications access to the Internet. That would prevent trojans to download your HD for examples. I looked around and played with iptables but I couldn't not find anything that do the job. I loaded the xt_owner kernel for iptables but the --cmd-owner command is lacking. That was my holy grail but could not get --cmd-owner to work. iptables -I OUTPUT -m owner --cmd-owner "firefox" -j LOG --log-prefix "Testing " How can I protect my machine against the enemy within.

OpenSuse 11.2
Kernel: 2.6.31.12-0.2-desktop

View 1 Replies View Related

Networking :: Identify Route For Some Network Clients Without Netmask?

Jun 10, 2009

have two internet lines from two isp every one pluged to interface eth0 and eth1 and i have eth2 interface to internel network clients now i need to make some clients to use line 1 and other use line 2 i want make this without use netmask , just for selected IP.

View 1 Replies View Related

Security :: Identify The Host To Block?

Feb 15, 2011

For the last four days, I have been getting HIDS alerts like these:

Code:
152.2.x.x - - [15/Feb/2011:04:28:59 -0500] "PROPFIND /C%24.co HTTP/1.1" 405 231
152.2.x.x - - [15/Feb/2011:04:28:59 -0500] "PROPFIND /C%24.com HTTP/1.1" 405 232

[code]....

View 7 Replies View Related

Ubuntu Security :: Identify Which Application Wants Keyring Access?

May 2, 2010

Is there a way to identify exactly what application is asking for keyring access at the given time? I get this query every boot and it's getting annoying. The annoyance is there, but more importantly and from a personal security standpoint on desktop systems, it's pretty bad that it doesn't say what application want's the access.

View 7 Replies View Related

OpenSUSE Network :: Can't Identify Wireless Chipset

Jan 18, 2010

I have a HP Pavilion dv2000 and can not figure out what chipset I have.

/sbin/lspci brings up the following
bunnyman@linux-bqo4:~> /sbin/lspci
00:00.0 Host bridge: Intel Corporation Mobile Memory Controller Hub (rev 0c)
00:02.0 VGA compatible controller: Intel Corporation Mobile Integrated Graphics Controller (rev 0c)
00:02.1 Display controller: Intel Corporation Mobile Integrated Graphics Controller (rev 0c)
[Code]....

where I can get the .inf file from? I took windows completely off of the computer and dont want to reinstall it just to get the driver.

View 9 Replies View Related

Ubuntu Networking :: Network Usage Constant - Find Out What Programs Are Using The Internet?

Jan 5, 2010

My wireless usb network adapter is constantly using ~100bytes/s even when there is nothing I can think of that needs to talk to the internet. Is there a way to find out what programs are using the internet?

View 2 Replies View Related

Security :: Checking What Processes Are Hidden?

Jan 13, 2010

I post this to have a memo about how I looked into this problem. You can use this command to check what is hidden.

Code:
/usr/lib/chkrootkit/chkproc -v -p 3 | grep /proc/ | sed 's/.*(/proc/[0-9]*).*/1/'| xargs -n1 -I %%% cat %%%/cmdline

If it doesn't output anything, then nothing is hidden currently. This usually means that a process was started between the ps command and the /proc check of chkrootkit. You can check what those command(s) are by running the above in a loop, with high priority.

[Code]...

Does anyone know how to get rid of these false positives while retaining other functionality of chkrootkit?

View 1 Replies View Related

Debian :: Identify The Network Eth0 - Eth1 - Eth2 Interfaces?

Jun 15, 2010

How do Linux identify the eth0, eth1, eth2 interfaces. For instance I plug in a network cable in to an interface. How do Linux recognize the plug in interface is eth0 or eth1?

View 1 Replies View Related

Ubuntu Security :: Do Not Know If There Are Scripts Running On The Processes Or Not?

May 7, 2011

To: The Cog >>>

Code:
The Cog, heres the reszults for ps -ef | grep tty:
yo mama@blah:~$ ps -ef | grep tty

[code]....

View 9 Replies View Related

Security :: Log The Names Of The Actual Processes That Initiate?

Jun 22, 2009

Is there an easy way to log the names of the actual processes that initiate, let's say, outbound connections from the Linux machine, for instance track what process initiates an outbound connection to MySQL port to remote machine and stuff like that?

View 3 Replies View Related

Security :: Prevent Normal Users See All The Processes Running On The Box?

Dec 30, 2010

I've a Linux box with few users (with shell). I would like to prevent normal users see all the processes running on the box. How can I implement this?

View 1 Replies View Related

Ubuntu Servers :: LAMP - Identify The Right Network Structure For A Data Intensive Website

May 18, 2010

identify the right network structure for a data intensive website, built on LAMP. I'm thinking of a load balanced website, and that it should have a mysql master/slave setup server. I'm no expert in this area, so any online resources are welcome. You can check out the website [URL] - but it will have 10 million items once the hardware can support it.

View 1 Replies View Related

Ubuntu Security :: Bunch Of Vmware-user-wra Processes Stall Cpu 100%

Mar 24, 2010

this is scary, bunch of vmware-user-wra processes stall cpu 100%!! What's going on? Server has just been restarted! Bere I restarted, the root started all this vmware-user-wra!! I was configuring vncserver! After restart, it's started by user roo300 which I have used to login via SecureShell!

Code:

top - 20:20:29 up 4 min, 85 users, load average: 76.57, 35.14, 13.60
Tasks: 629 total, 90 running, 539 sleeping, 0 stopped, 0 zombie
Cpu(s): 1.5%us, 98.5%sy, 0.0%ni, 0.0%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 3873304k total, 369500k used, 3503804k free, 50492k buffers

[code]....

View 2 Replies View Related

Ubuntu Security :: Multiple Unwanted Apache2 Processes Running?

Mar 3, 2011

my computer is often very slow, to the point of stalling. I tty'd in and when I ran ps -ef I noticed about 10 /usr/sbin/apache2 -k start I dont even want 1 apache running. Any suggestions why these are running, or how to stop it? Well, I can stop it with a sudo killall, but how can I make sure it doesnt happen again?

View 5 Replies View Related

General :: Network Manager Program Didn't Identify Huawai E160 Dongle - Can't Connect To The Internet

Feb 24, 2011

I'm using KDE 4.5 with Ubunthu 9.04 installed Laptop. The problem occurs when I'm going to connect internet with my Huawai E160 dongle. The network manager program didn't identify my dongle so I can't connect to the internet. I have create a broadband connection in network manager program.

I can connect to internet with GNOME desktop since dongle is detect and I can create a Broadband connection and connect to the internet.

View 12 Replies View Related

Ubuntu :: See What Processes Are Using The Network?

Jul 16, 2010

I keep the network window of System Monitor active on my panel to see if anything is going on with the network.

After the last upgrade, lucid has been having nonstop short, small bursts of network activity, showing in system monitor as received data of approx 60 kb, then 0, then ~60, then 0, continuously. This is occurring before any applications are opened.

Whatever it is, it starts to tie up the processor until performance is unusable.

The processes screen does not offer any clues, perhaps because the data transfers are so small and spaced out. It still should indicate what is tying up the CPU, though. In the attached screencap, you can see the network activity pattern in the system monitor window in the panel.

Is there any way to monitor what processes are accessing the network in order to see what is going on?

View 3 Replies View Related

Security :: Using Open Source Network Security Tools On Large Network

Jul 5, 2010

how efficient and effective are these snort, argus, ossec etc etc for an organization having 3500 PC Network, connected through 700+ Cisco Devices (Layer 2 and Layer 3), and scattered on 130 different sites (geographically)? what should be the combination of products and what should be the architecture for an efficient forensics activity?

View 2 Replies View Related

Ubuntu Networking :: Identify CAT 5 And CAT 6 Cables ?

Jun 14, 2010

The way to identify CAT 5 and CAT 6 cable?What are the differences between these two cables..?

View 8 Replies View Related

Networking :: Identify The Icmp Packet?

Dec 1, 2010

how to identify the icmp packets & marking. this below icmp packets marking is not working.

iptables -t mangle -A PREROUTING -p icmp -j MARK --set-mark 0x5
iptables -t mangle -A PREROUTING -p icmp -j RETURN

with the help of port no or any other how can i identify the icmp packet ?... This below two is working fine

iptables -t mangle -A PREROUTING -p tcp -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING -p tcp -j RETURN

iptables -t mangle -A PREROUTING -p udp -j MARK --set-mark 0x3
iptables -t mangle -A PREROUTING -p udp -j RETURN

View 1 Replies View Related

Networking :: Identify All PIDs Sharing A TCP/IP Stack?

Jul 26, 2011

Is there a linux command (or command combination or utility) that can identify all processes (PIDs) that are sharing a TCP/IP stack ?

View 4 Replies View Related

Ubuntu Networking :: Identify The Status Of The Ethernet Interafces?

Apr 13, 2011

How to identify the status of the ethernet interafces? on my machine, every interface shows "UP" nn matter the interface is connected or not:

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

View 4 Replies View Related

Fedora :: Finding Out What Processes Sending / Receiving Network Data?

Oct 27, 2010

I have a desklet that, occasionally after toying with network stuff, will tell me that large amounts of data are being sent/received. What's a good way to determine what processes are occupying these resources?!

View 14 Replies View Related

Networking :: Identify Which Infected Desktop Is Copying Files To NFS Share?

May 18, 2011

I have iomega appliance, which is based on Debian distribution. There is an NFS share that I have created which is without password.Since it is without password, there are some viruses copied. I want to find out which IP address is the source of these files. In other words, I want to know which PC is copying these infected files on the NFS share.

View 3 Replies View Related

Ubuntu Networking :: Can't Identify Process/Unbind Socket Blocking MongoDB

Mar 27, 2011

I'm running Ubuntu 10.10 64bit, and I'm a newbie when it comes to networking.

My issue is that there seems to be a socket bound to a port blocking MongoDB from accessing it's usual port 27017. The strange thing that it was working just fine until recently and I can't figure out what I did to screw things up... I can make it use a different port but the reason why it can't bind to the default port and why I can't fix it is really bothering me. I've tried rebooting the machine even with nothing else running when I try to run Mongo is still blocked giving the following message:

Code:
ropes@ropes:~/mongodb-linux-x86_64-1.8.0/bin$ ./mongod
./mongod --help for help and startup options
Sun Mar 27 14:08:14 [initandlisten] MongoDB starting : pid=2718 port=27017 dbpath=/data/db/ 64-bit

[Code]....

View 5 Replies View Related

Ubuntu Networking :: Connecting To Network Repeatedly Asking For Security Password?

Apr 9, 2010

I installed Ubuntu on an old desktop last night and am having some problems with my wireless connection.I've searched around a bit and tried a few solutions but nothing seems to be working so hopefully someone can help. I'm using a Netgear WG111v3 wireless USB adapter and am attempting to connect to a Sky Broadband modem, the connection shows up in the list of avaliable networks after clicking on the network symbol and after attempting to connect for a while it then asks for the WPA password.

I enter the password and then this repeats over and over again continuously asking for the password and me continuously entering it. I know the password is correct as I'm using it on my laptop and other home computer right now.I've tried connecting to a hidden wireless network and inserting the network name and password as some have suggested and I've also tried adding the details from my router into the connection; so that I have manually entered the information rather than automatically finding it, this also hasn't worked.I should probably add that earlier today I seemingly randomly got connected and then managed to run some updates but since then it has disconnected and the same problem is repeating over and over. Sorry if thats quite a long explanation but I thought I'd try and make it as clear as possible,

View 1 Replies View Related

General :: Security - Running Suspicious X Programs In GNU?

Mar 18, 2010

What the most harmful thing can malware program started as separate limited user account do if it has access to the X server? Network and filesystem things are already considered by chroot and netfilter.

It obviously can lock the screen and I will need to switch to other vt and kill it manually. Can it for example disrupt other GUI programs on the same X server (access a root terminal in nearby window)?

I know that it is safer to run it in separate X server, for example, in Xtightvnc or even some virtual machine, but how dangerous is to just run it like other programs?

View 3 Replies View Related

Ubuntu :: Security Patches For Compiled Programs

Apr 27, 2010

I recently installed mplayer I compiled from svn, and now Ubuntu's package manager is showing security patches. If I install these patches, will it mess up the version I compiled and installed?

View 5 Replies View Related

Ubuntu Security :: Link To WINE Programs Gone?

Mar 10, 2011

After reading Bodhi's Ubuntu security sticky, I removed the links between WINE and the various folders. However, I've lost the menu items for my programs.

The menu no longer has MS Office in there and the only way to launch these is to do into .wine and launch it from there.

How can I bring back these links?

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved