QuestionQ47

Threat Hunting and Detection

Jack, a forensic investigator, was assigned by an organization to conduct a security audit on a Linux system. During this process, Jack gathered information about the system’s current status and enumerated all applications running on different ports to identify malicious programs.

Which of the following commands can help Jack identify programs/processes associated with open ports?

  • A netstat -rn
  • B ip r
  • C netstat -tulpn
  • D netstat -i
Explanation

netstat -tulpn displays listening TCP and UDP sockets and includes the PID and name of the program that owns each socket. The -p option provides the process/program association, while -l restricts the output to listening ports.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!