Friday, April 30, 2010

Catch infected machines with TCPDUMP

tcpdump -l -n arp | egrep 'arp who-has' | head -100 | awk '{ print $NF }' |sort | uniq -c | sort -n

No comments:

Post a Comment