mailing list archives
fs rootkit performance footprint [was Re: "IO wait chains" in Linux??]
From: coderman <coderman () gmail com>
Date: Mon, 7 Feb 2011 17:00:44 -0800
On Mon, Feb 7, 2011 at 4:49 PM, coderman <coderman () gmail com> wrote:
...general idiom is
setup measurement and load injection, then executive to define peak /
best capacity configuration.
oprofile / kprobes /sysprof help with measurement rather than load injection.
interestingly, memory backed file system performance benchmarks
exhibit a distinct performance degredation depending on the type of
kernel mode rootkit hooking implemented on a compromised host. a poor
rootkit revealer, but surprisingly effective. a good exercise for
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- fs rootkit performance footprint [was Re: "IO wait chains" in Linux??] coderman (Feb 08)