Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

fs rootkit performance footprint [was Re: "IO wait chains" in Linux??]
From: coderman <coderman () gmail com>
Date: Mon, 7 Feb 2011 17:00:44 -0800

On Mon, Feb 7, 2011 at 4:49 PM, coderman <coderman () gmail com> wrote:
...general idiom is
setup measurement and load injection, then executive to define peak /
best capacity configuration.
...
oprofile / kprobes /sysprof help with measurement rather than load injection.


interestingly, memory backed file system performance benchmarks
exhibit a distinct performance degredation depending on the type of
kernel mode rootkit hooking implemented on a compromised host.  a poor
rootkit revealer, but surprisingly effective. a good exercise for
reader...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
  • fs rootkit performance footprint [was Re: "IO wait chains" in Linux??] coderman (Feb 08)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]