[no subject]

On Monday 19 April 2004 20:35, James P. Kinney III wrote:
> I put up a page with the binaries and source on it :
>
&gt; <a  rel="nofollow" href="http://www.localnetsolutions.com/tools/";>http://www.localnetsolutions.com/tools/</a>
&gt;
&gt; Note: the procps page on sourceforge did not have an md5 checksum.
&gt;
&gt; On Mon, 2004-04-19 at 20:02, David Corbin wrote:
&gt; &gt; On Monday 19 April 2004 15:01, James P. Kinney III wrote:
&gt; &gt; &gt; If it is a cracked machine, running a statically linked top from a CD
&gt; &gt; &gt; will gain access to the real top data. Top is a common binary to fiddle
&gt; &gt; &gt; with with a root kit.
&gt; &gt;
&gt; &gt; Sounds reasonable.  Can you point me at such, or if not that, anybody got
&gt; &gt; any idea where the source to top is and I'll build my own.
&gt; &gt;
&gt; &gt; &gt; It is certainly possible to _add_ a module or _remove_ a module, but
&gt; &gt; &gt; change out the kernel with out a reboot (unless 2-kernel-monte is
&gt; &gt; &gt; available, I have not been able to find this :(  ). So the actual data
&gt; &gt; &gt; stream for top is not tamper-able easily. Thus a known good
&gt; &gt; &gt; statically-linked top would give access to the running system and show
&gt; &gt; &gt; the _real_ processes that are running.
&gt; &gt; &gt;
&gt; &gt; &gt; If top shows no malicious files, it's time to take some snapshots over
&gt; &gt; &gt; time to plot which app is failing.
&gt; &gt; &gt;
&gt; &gt; &gt; #!/bin/sh
&gt; &gt; &gt; echo date &gt;&gt; /tmp/top.txt
&gt; &gt; &gt; top -b -n 1 -c &gt;&gt; /tmp/top.txt
&gt; &gt; &gt; echo &quot;###############&quot; &gt;&gt;/tmp/top.txt
&gt; &gt; &gt; echo &gt;&gt;/tmp/top.txt
&gt; &gt; &gt; echo &gt;&gt;/tmp/top.txt
&gt; &gt; &gt;
&gt; &gt; &gt; Run as a cron every minute for an hour.
&gt; &gt; &gt;
&gt; &gt; &gt; If you want, you can now mash/mangle the data into a nice plot using
&gt; &gt; &gt; some perl and gnplot (or a spreadsheet).
&gt; &gt; &gt;
&gt; &gt; &gt; On Mon, 2004-04-19 at 11:56, Geoffrey wrote:
&gt; &gt; &gt; &gt; Dow Hurst wrote:
&gt; &gt; &gt; &gt; &gt; How can we find the process that is soaking the memory?  How do you
&gt; &gt; &gt; &gt; &gt; manipulate /proc to find out the originating process that owns the
&gt; &gt; &gt; &gt; &gt; memory being used?  I know IRIX had tools to look at memory and see
&gt; &gt; &gt; &gt; &gt; which processes owned what part of memory.  Does Linux?
&gt; &gt; &gt; &gt; &gt;
&gt; &gt; &gt; &gt; &gt; Seems if you knew what was leaking you would have a major part of
&gt; &gt; &gt; &gt; &gt; the battle won.
&gt; &gt; &gt; &gt;
&gt; &gt; &gt; &gt; I believe we mentioned top, but he noted that doesn't give him
&gt; &gt; &gt; &gt; anything. That's what concerns me.  If it doesn't show, is it being
&gt; &gt; &gt; &gt; hidden for a reason???


</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00645" href="msg00645.html">[ale] diagnosis</a></strong>
<ul><li><em>From:</em> dcorbin at machturtle.com (David Corbin)</li></ul></li>
<li><strong><a name="00782" href="msg00782.html">[ale] diagnosis</a></strong>
<ul><li><em>From:</em> dcorbin at machturtle.com (David Corbin)</li></ul></li>
<li><strong><a name="00784" href="msg00784.html">[ale] diagnosis</a></strong>
<ul><li><em>From:</em> jkinney at localnetsolutions.com (James P. Kinney III)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00810.html">[ale] ipv6 dns requests???</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00812.html">[ale] Linux Cluster Server Room</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00784.html">[ale] diagnosis</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg01037.html">[ale] diagnosis</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00811"><strong>Date</strong></a></li>
<li><a href="threads.html#00811"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>