[Full-disclosure] fs rootkit performance footprint [was Re: "IO wait chains" in Linux??]

[coderman <coderman@xxxxxxxxx>]

On Mon, Feb 7, 2011 at 4:49 PM, coderman <coderman@xxxxxxxxx> wrote:
> ...general idiom is
> setup measurement and load injection, then executive to define peak /
> best capacity configuration.
> ...
> oprofile / kprobes /sysprof help with measurement rather than load injection.


interestingly, memory backed file system performance benchmarks
exhibit a distinct performance degredation depending on the type of
kernel mode rootkit hooking implemented on a compromised host.  a poor
rootkit revealer, but surprisingly effective. a good exercise for
reader...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/