Follow a Connection

You cleaned unwanted programs in the previous section. Now you will investigate the paths those programs use to reach other computers. The earlier cleanup and account protections are still in place.

A connection record gives you a source, a destination and a port. In this practice example:

seclab inspect connections demo-upload

You should see:

demo-upload:
  Source: practice-laptop
  Destination: parcel-cache
  Port: 443
  Process: demo-helper
  Credential: -
  Group: -
  Ip: -
  Allowed: yes
  Reason: allowed
  Rule: 1

The source is practice-laptop. The destination is parcel-cache, and port 443 is the service it contacted. The process field tells you which program opened the connection.

Port 443 is commonly used for secure web traffic, but that does not make every connection to it safe. Check who is connecting, where they are going and whether the activity is approved.

Record a destination using its machine name:

seclab answer destination parcel-cache

You should see:

Recorded your answer to destination.