A systems administrator is trying to track down a rogue process that has a TCP listener on a network interface for remote command-and-control…

The best commands to use to generate a list of rogue process names that have a TCP listener on a

network interface are

A. netstat -antp | grep LISTEN and

B. lsof -iTCP | grep LISTEN. These commands

will show the process ID (PID) and name of the processes that are listening on TCP ports, which can

be used to identify any suspicious or unauthorized processes. The other commands are either not

specific enough, not valid, or not relevant for this task. For example:

C . lsof -i:22 | grep TCP will only show the processes that are listening on port 22, which is typically

used for SSH, and not any other ports.

D . netstat -a | grep TCP will show all the TCP connections, both active and listening, but not the

process names or IDs.

E . nmap -p1-65535 | grep -i tcp will scan all the TCP ports on the local host, but not show the process

names or IDs.

F. nmap -sS 0.0.0.0/0 will perform a stealth scan on the entire internet, which is not only impractical,

but also illegal in some countries.