Introduction
Core to successful cyber operations is the ability to maintain the integrity and availability of computer systems and networks. The first step in this process is knowing what is occurring on defended systems and networks. Both Windows and Linux feature tools that provide information about running processes, system users, and network connections. Network traffic between systems can be captured and analyzed with tools including tcpdump and Wireshark. In this chapter, the reader will learn what live information is available to a system administrator facing a potentially compromised system ...
