0

For a software package, say, a debian .deb file. After installing it, how do I watch it's local and network activities? For local activities I want to see how its files interact with each other and with other programs in my system. For network activities, I want to see which IP it is trying to communicate and what data it is trying to send and receive.

The ultimate goal is to see if a program modify anything; or send and receive something unexpected.

I wonder why there are not many tools for this purpose? Wireshark seems to be able to handle the network activities part in my question. But it seems to require much of work to get the information.

Am I asking the wrong question, or should I use a different approach. Or it it possible at all?

A a real example, I want to check out this application: http://terashare.net/ before using it.

1 Answer 1

1

You can try to run the application with strace (traces system calls) or ltrace (traces library calls). Be prepared that you can now see "if a program modifies anything", and that's a lot of information.

If you just want to monitor network interaction, run it in a network namespace with a veth pair into the main namespace (and possibly NAT), then run wireshark on one veth. Again, if the program is expected to do network interaction, you'll get a lot of data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .