Investigating network connections

Network activity analysis helps us determine which processes are establishing network connections, as well as which IP addresses and ports are being used. Since most malware and post-exploitation tools establish network connections, investigating network activity is one of our top priorities. In the case of macOS, Volatility offers a number of plugins to examine network interfaces, active network connections, and the contents of routing tables.

We can use the mac_ifconfig plugin to get information about the configuration of the network interfaces of the host under investigation:

Figure 11.1 – Volatility mac_ifconfig output

As you can see in the figure, this plugin provides information about the names of interfaces, their assigned IP and MAC addresses, as well as the set promiscuous mode.

Important Note

Promiscuous mode is a mode for a network interface controller that forces the controller to pass all the...