Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

How do I record the outbound 'attack' traffic from a botnet on a Windows XP machine? The captured traffic will be in the Windows XP firewall log.

I need to setup some kind of an experiment where I can use a Win XP firewall log for later analysis, for research purpose.

share|improve this question

2 Answers

up vote 2 down vote

If you want to use the XP firewall log, just enable it - it works tolerably well.

Better may be to use wireshark, which will log the actual data sent out from the machine

share|improve this answer
Thanks for your reply! I think a real life experiment could work. Setting up a vulnerable XP machine for a fixed amount of time, with logging enabled etc. Though there must be other ways – Nocker Mar 24 '11 at 14:01
1  
@nocker - depending on what you want to do, look on the honeynet.org web pages. They have stacks of data on botnet comms etc – Rory Alsop♦ Mar 24 '11 at 14:08
up vote 2 down vote

This posting on Getting Started with Basic Malware Analysis was almost built to answer to this question.

The author of the blog post explains using Remnux with fake DNS, fake services, etc as the gateway to a malware infected Windows XP machine. He also mentions putting a Dionaea instance on the network as well, to see if the infected host attacks it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.