Linux Malware Incident Response: A Practitioner’s Guide to Forensic Collection and Examination of Volatile Data by Cameron Malin & Eoghan Casey & James Aquilina

Author:Cameron Malin & Eoghan Casey & James Aquilina
Language: eng
Format: epub, mobi
ISBN: 9780124114890
Publisher: Elsevier Inc.
Published: 2013-03-01T16:00:00+00:00

Figure 1.33 Routing table on a Linux system displayed using the netstat -nr command.

ARP Cache

The ARP cache maintains information about current and recent connections between computers. In some situations, an IP address may not be sufficient to determine which specific physical computer on the network is connected to a compromised system, making it necessary to use hardware addresses such as the Media Access Control (MAC) that is stored in an ARP table.

• The arp command displays the Address Resolution Protocol (ARP) cache on a Linux system, which provides a list of IP addresses with their associated MAC addresses of systems on the local subnet that the subject system has communicated with recently (Fig. 1.34).

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.