meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
soc:irt:linux:start [2026/06/11 15:35] – titannetsoc:irt:linux:start [2026/06/11 15:53] (current) – titannet
Line 1: Line 1:
 ====== Linux ====== ====== Linux ======
  
 +
 +===== Live and Disk System =====
 +
 +
 +==== Process Information ====
  
 <code bash> <code bash>
Line 14: Line 19:
  
 # open ports, assume folder /proc/{pid}/ # open ports, assume folder /proc/{pid}/
-cat net/tcp | awk 'NR>1 {split($2, a, ":"); printf "%d\n", "0x" a[2]}' +cat ./net/tcp | awk 'NR>1 {split($2, a, ":"); printf "%d\n", "0x" a[2]}' 
-cat /net/udp | awk 'NR>1 {split($2, a, ":"); printf "%d\n", "0x" a[2]}'+ 
 +# local ip's and ports 
 +awk 'NR>1 { 
 +    split($2, a, ":") 
 +    hex = a[1] 
 +    # Extract bytes (IP is little-endian in the file) 
 +    b1 = substr(hex,7,2); b2 = substr(hex,5,2) 
 +    b3 = substr(hex,3,2); b4 = substr(hex,1,2) 
 +    printf "%d.%d.%d.%d:%d\n", 
 +        "0x"b1, "0x"b2, "0x"b3, "0x"b4, 
 +        "0x"a[2] 
 +}' ./net/tcp 
 + 
 + 
 # connected local ip's # connected local ip's
 cat /net/arp cat /net/arp
 +cat /net/route
 +
 +</code>
 +
 +==== Logs ====
 +
 +<code bash>
 +/var/log/...         # most system logs
 +/var/log/journal     # binary system logs, readable with journalctl
  
  
 </code> </code>
 +
 +==== Triage ====
 +
 +  * [[soc:irt:linux:tools:uac]]
 +
 +
 +
 +
 +
 +
 +===== Live =====
 +
 +
 +==== Basic System Info ====
 +
  
 <code bash> <code bash>