Linux: Use a command terminal, such as xterm or konsole.
Windows: Start > Run, type cmd.exe and press Enter for the command prompt.
Dump network traffic from your ethernet device eth0 to a text file called mydump. CTRL+c will stop tcpdump (or any console application in the foreground). Review the dump file with vi, cat, gedit or nano for suspicious ports and connections.
Replace eth0 with your ethernet device gathered from ifconfig.
Get SMART information for your IDE/ATA hard drives. Use "/dev/hda[b-t]" for any additional IDE/ATA devices. Notable "Attributes" to keep an eye on are Raw_Read_Error_Rate, Seek_Error_Rate, Power_On_Hours and Temperature_Celsius.
Requires smartmontools be installed:
Red Hat Enterprise Linux and rebuilds: yum install smartmontools
Ubuntu and Debian: apt-get smartmontools
Get SMART information for your SATA hard drives (SATA devices using libata). Use "/dev/sda[b-t]" for any additional SATA hard drives (SATA devices using libata). Notable "Attributes" to keep an eye on are Raw_Read_Error_Rate, Seek_Error_Rate, Power_On_Hours and Temperature_Celsius.
Requires smartmontools be installed:
Red Hat Enterprise Linux and rebuilds: yum install smartmontools
Ubuntu and Debian: apt-get smartmontools
Synchronize files from your user home folder to a remote server using ssh for encryption. Replace username with your own user account and servername with the IP or domain of the remote server.
For convenience, add this command to your crontab (assuming you have passwordless ssh setup).
Requires rsync be installed:
Red Hat Enterprise Linux and rebuilds: yum install rsync
Ubuntu and Debian: apt-get rsync
Check for possible rootkits and viruses.
You must have chkrootkit installed.
Red Hat Enterprise Linux and rebuilds: yum install chkrootkit
Ubuntu and Debian: apt-get install chkrootkit
Run a rootkithunter check for possible trojans, rootkits, and exploits.
You must have rkhunter installed.
Red Hat Enterprise Linux and rebuilds: yum install rkhunter
Ubuntu and Debian: apt-get install rkhunter
List the contents of your crontab -- unfamiliar jobs should be double-checked.
Review your Linux /etc/hosts file for suspicious IP mappings.
Find and print out all hidden files. Use the -iname switch for case insensitive matching.
Find files larger than 10 megabytes on a system.
Recent comments
1 year 5 weeks ago
1 year 5 weeks ago