Honeypots mailing list archives
RE: any other tool to detect worm?
From: "Taylor, David" <ltr () nursing upenn edu>
Date: Sun, 2 May 2004 10:30:42 -0400
You can always use TCPDUMP or WINDUMP to observe traffic. If you are needing to do this from a single PC with Windows you can download WINPCAP and WINDUMP from http://netgroup-serv.polito.it/netgroup/tools.html. If you have Linux you can use TCPDUMP which is installed by default on a lot of platforms. WINDUMP is a Win32 port of TCPDUMP so the command line is pretty much the same. You can pass these tools specific filters to watch certain traffic. For instance, if you have a pc at home that does not offer services to other computers on the Internet such as a web server, etc. You can watch unsolicited traffic and begin to see patterns. I was using this when blaster was born and knew right away there was a new worm. So, if you want to watch traffic on your home pc you can: (read the manual on how to get your adapter) Windump -tnn tcp[13]==0x02 and dst host your.ip This line above will give you all TCP connection requests heading TO your ip address and has the SYN flag set which indicates a new connection request. Hope that helps -----Original Message----- From: dcneting [mailto:ansiry () tm net my] Sent: Friday, April 30, 2004 8:20 PM To: focus-virus () securityfocus com; honeypots () securityfocus com Subject: any other tool to detect worm? ________________________________ From: dcneting [mailto:ansiry () tm net my] Sent: Saturday, May 01, 2004 8:18 AM To: 'focus-virus () securityfocus com' Subject: any other tool to detect worm? is there any tools that i can use to just detect worm-like activity besides that using honeyd? if there is, how can i use it to detect worms(known and unknown) preferably open source platform.
Current thread:
- any other tool to detect worm? dcneting (May 01)
- Re: any other tool to detect worm? bugtraq (May 01)
- Re: any other tool to detect worm? James Riden (May 02)
- RE: any other tool to detect worm? Bojan Zdrnja (May 08)
- Re: any other tool to detect worm? Niels Provos (May 08)
- RE: any other tool to detect worm? Dan Hawrylkiw (May 13)
- Final Year Project Ideas Reena Pau (May 13)
- <Possible follow-ups>
- RE: any other tool to detect worm? Taylor, David (May 02)