Hi,<br><br>I&#39;m trying to catch all events of any net sniffers aka tcpdump, snoop, ethereal... I think I managed to make a rule that will do that:<br><br>-a entry,always -S socketcall -F euid=0 -F a0=3<br><br>I&#39;ve played around and I think it does the trick. Do you see any problems with this rule?<br>
<br>The problem I&#39;m trying to solve now is how to get a daily report of all such events. I was trying to filter it on <br>ausearch -m SYSCALL -sc socketcall -ue 0<br>but I get all possilble sshd,ftpd and the bunch as well.. I could do post processing with a whitelist and ignore all I know are ok, but it would be much nicer if I could get the search a bit narrower in the first place. Any ideas?<br>
<br>Thanks<br>Jure<br>