Who's watching your Computer now?

[GreyGeek]

Please do. It is a package well written and extremely powerful.
It will probably take me the rest of my life to figure out all the options and the things that can be done with it. Fun, fun, fun!!

[SteveRiley]

I'll pass your praise on to Gerald Combs next time I see him in the halls at the office

[GreyGeek]

Played with Wireshark. I have one word for it .... SWEET!

[GreyGeek]

Never tried Wireshark but, based on the recommendation and the fact that it is in the repository I am installing it now, as I type!

[Feathers McGraw]

It does indeed. Never again, broadcom... never. again.

[SteveRiley]

Oh right. Feels nice, doesn't it?

[Feathers McGraw]

I upgraded my whole laptop to something not rubbish!

[SteveRiley]

Did you upgrade your wi-fi to something not rubbish?

[Feathers McGraw]

Last time I looked at wireshark I found it a bit overwhelming and had some problems using it properly because of my rubbish WiFi card at the time. Perhaps it's time for another look, I've learned quite a bit about networking since then.

[SteveRiley]

Wireshark is another one I feel I should invest some time in, networks are fascinating and I'm sure it would lead to other interesting knowledge.

It's a great tool. Naw, I'm not biased.

[GreyGeek]

... By the way, my adventures with C++ and sqlite are coming along (slowly!). It's a very rewarding process, I've had a few eureka moments today already where something clicked and I understood rather than just copying. I'm writing a text based program at the moment but will put a qt GUI on it when it is functional!

If it is a single purpose utility program that approach is the best. You can test it in a konsole and when it runs right you can design a GUI around it. Isn't it a lot of fun?

[Feathers McGraw]

I wish I had more time to learn about all of these tools, there are so many cool free software projects out there! It's amazing that people give so much of their time for free and share their software, and that other people spend their time packaging it for different distributions.

Of the ones you listed, I have only used nmap (on my local network mainly). Wireshark is another one I feel I should invest some time in, networks are fascinating and I'm sure it would lead to other interesting knowledge.

By the way, my adventures with C++ and sqlite are coming along (slowly!). It's a very rewarding process, I've had a few eureka moments today already where something clicked and I understood rather than just copying. I'm writing a text based program at the moment but will put a qt GUI on it when it is functional!

[GreyGeek]

I don't remember where I read it but I think it was ubuntuforums - when you mentioned it I thought it must be worth another look, which is why I asked. As I was hoping, you gave a really useful answer - thanks!

Setting them as a cron job sounds much more convenient than I thought it would be.

Have you ever used snort (the intrusion detection software)? That's another one I'm curious about.

The cron config files are installed by default (/etc/chkrootkit.conf) and (/etc/default/rkhunter) and all you have to do is edit the true/false conditions to suit your needs.

I have snort, nmap, etherape, kismet and zenmap installed. I play with them but haven't had a real need for them because I don't have much pounding on my back door ... and ... using them injudiciously can get you in trouble with your ISP. I probably use EtherApe and Kismet more than the others because they show me all the devices connected to my computer/wifi.

[Feathers McGraw]

I don't remember where I read it but I think it was ubuntuforums - when you mentioned it I thought it must be worth another look, which is why I asked. As I was hoping, you gave a really useful answer - thanks!

Setting them as a cron job sounds much more convenient than I thought it would be.

Have you ever used snort (the intrusion detection software)? That's another one I'm curious about.

[GreyGeek]

You mentioned RKHunter and ChkRootKit, have you ever used them? I think I remember reading about them about a year ago and the consensus was that they were out of date, I'm curious to know how good they are.

I don't know where you got that "consensus" but both are currently maintained.
I've run them both for almost 10 years.
https://help.ubuntu.com/community/RKhunter
http://www.chkrootkit.org/

The received wisdom is to run them both. Like any detection tool, it is no more secure than the most recent update to its db, which it does automatically in the background.

In 10 years I have yet to see any malware detected on my equipment, but I run it regularly as a cron task every week. You can change the settings in /etc/default/rkhunter to set the cron task to what ever you want. I have it run daily, nice="0", with email reports of results of the run to my home account and email notifications of db updates.

chkrootkit also has a cron file that sets it to run daily in the background.

They are pretty much transparent and I never notice them.