??GNSS 2# telnet 192.168.0.1
??Connected to 192.168.0.1.
??login: hapless
??password:
??[hapless@linux2 hapless]$ w
?? 19:55:29 up 58 min, 4 users, load average: 0.00, 0.00, 0.00
??USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
??root tty1 7:44pm 27.00s 0.17s 0.06s -bash
??root tty2 7:46pm 1:56 0.24s 0.01s linuxsniff
??root tty3 7:44pm 10:43 0.17s 0.07s -bash
??hapless ttyp0 gnss 7:55pm 1.00s 0.26s 0.04s w
??[hapless@linux2 hapless]$ who
??root tty1 May 20 19:44
??root tty2 May 20 19:46
??root tty3 May 20 19:44
??hapless ttyp0 May 20 19:55 (gnss)
??[hapless@linux2 hapless]$ finger -l
??Login: root Name: root
??Directory: /root Shell: /bin/bash
??On since Thu May 20 19:44 (PDT) on tty1 35 seconds idle
??On since Thu May 20 19:46 (PDT) on tty2 2 minutes 4 seconds idle
??On since Thu May 20 19:44 (PDT) on tty3 10 minutes 51 seconds idle
??No mail.
??No Plan.
??Login: hapless Name: Caldera OpenLinux User
??Directory: /home/hapless Shell: /bin/bash
??On since Thu May 20 19:55 (PDT) on ttyp0 from gnss
??No mail.
??No Plan.
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 ff fc 27 - ..‘
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 ff fa 1f 00 50 00 28 ff - f0 ....P.(..
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 ff fa 20 00 33 38 34 30 - 30 2c 33 38 34 30 30 ff
.. .38400,38400.
0010 f0 ff fa 23 00 47 4e 53 - 53 3a 30 2e 30 ff f0 ff
...#.GNSS:0.0...
0020 fa 18 00 49 52 49 53 2d - 41 4e 53 49 2d 4e 45 54
...IRIS-ANSI-NET
0030 ff f0 - ..
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 ff fc 01 - ...
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 ff fd 01 - ...
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
随后,linux_sniffer记录了登录过程,下面用黑体表示:
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 68 - h
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 61 - a
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 70 - p
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 6c - l
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 65 - e
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 73 - s
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 73 - s
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 0d 00 - ..
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 75 - u
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 6e - n
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 61 - a
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 77 - w
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 61 - a
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 72 - r
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 65 - e
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
最后,linux_sniffer记录了所有的命令:
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 77 - w
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 0d 00 - ..
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 77 - w
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 68 - h
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 6f - o
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 0d 00 - ..
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 66 - f
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 69 - i
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 6e - n
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 67 - g
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 65 - e
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]
0000 72 - r
eth
proto: 080008:00:69:07:3e:db->00:e0:29:19:4a:68 192.168.0.1[1239] ->192.168.0.2[23]