MENU
Jack, a forensic investigator, was appointed by an organization to perform a security audit on a Linux system. In this process, Jack collected information about the present status of the system and listed all the applications running on various ports to detect malicious programs.
Which of the following commands can help Jack determine any programs/processes associated with open ports?
On Linux, a key step in a forensic triage or security audit is mapping open/listening ports to the owning process so investigators can identify suspicious services (backdoors, unauthorized daemons, rogue remote-access tools) and correlate them with binaries, users, startup mechanisms, and timestamps. The command netstat -tulpn is designed for exactly this purpose. In this switch set: -t limits output to TCP sockets, -u includes UDP sockets, -l shows only listening sockets (open ports awaiting connections), -p displays the owning process name and PID, and -n prevents name resolution by showing numeric IP addresses and ports (faster and avoids altering evidence via DNS queries). This combination yields a concise list of active listening ports and the processes bound to them, which is highly valuable for detecting unexpected services and attributing network exposure to a specific executable.
The other options do not provide process-to-port attribution: netstat -i shows interface statistics, ip r shows the routing table, and netstat -rn displays the routing table in numeric form. Therefore, the correct command is netstat -tulpn (D).
Currently there are no comments in this discussion, be the first to comment!