MarkMurdock
12/16/2021, 7:10 PMuser@server:/usr/local/build# tcpdump -n -i ens160 -s 1514 host 10.126.3.32
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens160, link-type EN10MB (Ethernet), capture size 1514 bytes
19:08:01.249229 IP 10.126.3.32.56300 > 10.126.3.149.8080: Flags [.], seq 668286310:668286311, ack 3209453802, win 2052, length 1: HTTP
19:08:01.249250 IP 10.126.3.149.8080 > 10.126.3.32.56300: Flags [.], ack 1, win 501, options [nop,nop,sack 1 {0:1}], length 0
19:08:16.260289 IP 10.126.3.32.56300 > 10.126.3.149.8080: Flags [.], seq 0:1, ack 1, win 2052, length 1: HTTP
19:08:16.260308 IP 10.126.3.149.8080 > 10.126.3.32.56300: Flags [.], ack 1, win 501, options [nop,nop,sack 1 {0:1}], length 0
19:08:31.269602 IP 10.126.3.32.56300 > 10.126.3.149.8080: Flags [.], seq 0:1, ack 1, win 2052, length 1: HTTP
19:08:31.269621 IP 10.126.3.149.8080 > 10.126.3.32.56300: Flags [.], ack 1, win 501, options [nop,nop,sack 1 {0:1}], length 0
^C
6 packets captured
6 packets received by filter
0 packets dropped by kernel
Benjamin Edwards
12/16/2021, 8:26 PMfleet osquery
(via fleetctl package)
unfortunately on windows services don't get logged well. If you can capture any logs that would be helpful.
I usually capture logs by running it manually via Powershell:
"C:\Program Files\Orbit\bin\orbit\orbit.exe" --root-dir "C:\Program Files\Orbit\." --log-file "C:\Program Files\Orbit\orbit-log.txt" --fleet-url "<https://dogfood.fleetdm.com>" --enroll-secret-path "C:\Program Files\Orbit\secret.txt" --update-url "<https://tuf.fleetctl.com>" --orbit-channel "stable" --osqueryd-channel "stable"
for example, and then it'll log to stdoutMarkMurdock
12/16/2021, 8:34 PMBenjamin Edwards
12/16/2021, 8:49 PMMarkMurdock
12/17/2021, 12:57 AM