Full Disclosure mailing list archives
fs rootkit performance footprint [was Re: "IO wait chains" in Linux??]
From: coderman <coderman () gmail com>
Date: Mon, 7 Feb 2011 17:00:44 -0800
On Mon, Feb 7, 2011 at 4:49 PM, coderman <coderman () gmail com> wrote:
...general idiom is setup measurement and load injection, then executive to define peak / best capacity configuration. ... oprofile / kprobes /sysprof help with measurement rather than load injection.
interestingly, memory backed file system performance benchmarks exhibit a distinct performance degredation depending on the type of kernel mode rootkit hooking implemented on a compromised host. a poor rootkit revealer, but surprisingly effective. a good exercise for reader... _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- fs rootkit performance footprint [was Re: "IO wait chains" in Linux??] coderman (Feb 07)