3 ms·
I save all SYN packets on my router, it's noisy but a useful audit trail: tcpdump "tcp[13] & 2 != 0" Yes, I'm aware malware could use UDP/ICMP. It could a
by 0daystock 4y ago
I save all SYN packets on my router, it's noisy but a useful audit trail:
tcpdump "tcp[13] & 2 != 0"
Yes, I'm aware malware could use UDP/ICMP. It could also domain-front on 443 and I'm not under any disillusion this adds meaningful resistance to malicious software; it's just interesting to observe.
- iso1631 4y agoSure, and perhaps handy once you are hit, but how do you check those for any teltale signs of infection before you know what you're specifically looking for