Network Connection Data

shadow_cat · 01-08-2018, 01:09 PM

Hello Listmates.
I am reviewing a Linux System (CentOS). There were other Security Network tools that showed the Linux system either reached out to a "bad" IP, or that a "bad" IP reached back to the machine. SO The Question: Is there any data that is held on a Linux machine (after it was powered down) that would hold any of this data? If so, could you please guide me to the file, or commands to get that info?

Thank you in advance for your thoughts.
-Rob

shadow_cat · 01-09-2018, 08:31 AM

Also, is there anything that I could install on a Linux machine to help capture the network traffic flowing to and from the machine?
Thanks again!
-Rob

camp0 · 01-16-2018, 03:11 AM

Hi,

Probably what you need is some traffic monitoring tools such as iptraf, snort, suricata, aiengine and so on. Not sure of what your problem is.....would you mind to describe a bit?

////// · 01-16-2018, 11:11 AM

Quote:

Originally Posted by shadow_cat

Also, is there anything that I could install on a Linux machine to help capture the network traffic flowing to and from the machine?
Thanks again!
-Rob

tcpdump.

https://www.tcpdump.org/tcpdump_man.html