RE: possible rooted systems

["Beauford, Jason" <jbeauford () EightInOnePet com>]

You don't necessarily need a NOVELL based SNIFFER.

You could hook up any box and run a LIVE LINUX CD.  You can use the
"built-in" (Depends on distribution) ETHEREAL sniffer to sniff packets
off the wire.

Another nice tool you can use is NTOP.  NTOP sniffs packets off the wire
and breaks down the communication processes into GRAPHICAL
representation.  Very handy little tool.

I'd recommend downloading and burning the KNOPPIX STD .iso, hooking up a
hub between your Firewall and your MAIN SWITCH.  Hook up any PC box or
laptop, boot up your KNOPPIX STD Disk and monitor away.

Knoppix STD here:  http://www.knoppix-std.org/

Most likely, you are having some sort of FILE SHARING/ P2P issues.
Maybe even LAN Based Gaming (Trust me.. Not beyond the realm of
possibilities.. You can download the Unreal Tournament 2004 demo and
have hours of fun on a School or even Corporate LAN =) )

Take a look at commercial products to monitor/limit incoming/outgoing
traffic, i.e. Websense: http://www.websense.com.

Or if your Firewall allows for it, block egress traffic there.  Speaking
of Firewalls, your may have a logging feature which can log packets to a
SYSLOG Server.  If that's the case, set it up and log all traffic in and
out to a central server (Sorry not familiar with NOVELL Syslog
Servers/Daemons.) There's KIWI SYSLOG SERVER for Windows.  It's a
freebie and works great!  Maybe setup SNORT for IDS purposes?

Firstly, if it were me, I'd check out the Knoppix STD Disk.  You can
gather some great data from that.  All the other stuff is preventative
after you fix the problem.

Kind Regards,

JMB

-----Original Message-----
From: kyle [mailto:kyle () inetconnection com] 
Sent: Thursday, October 28, 2004 8:13 AM
To: security-basics () securityfocus com
Subject: possible rooted systems


I am a lan administrator at a small school system with a T1 line for the

internet. Lately I've noticed that the T1 line has been maxed, and a
week 
later, it still is maxed out. I strongly believe that a few systems have
been 
rooted (no viruses/trojans show up on scans) and need a novell based
packet 
sniffer to determine what is legitimate and illegitimate traffic. Does
anyone 
know of any good ones? We run many xp and 98 boxes with multiple novell 
servers. I think some of the 98 boxes are the ones that were rooted On
using 
them I've noticed one common thing on every one of them at that
building. 
spyware beyond usage (current record 35000 entries before adaware locked
up). 
I know how I can just fix it, but I need some sort of log so I can
justify my 
means. ;)
Thanks
Kyle