On Sat, Mar 17, 2001 at 12:32:03AM -0500, S . Salman Ahmed wrote: > > Any other ways I can try and detect this rootkit on my systems ? > Knark can't function if you have disabled module loading. It is a module, so it can't do anything if it can't be run. Did you say that the kernel logs a message about switching to/from promisc mode if you do an 'ifconfig promisc' or 'ifconfig -promisc'? noah -- _______________________________________________________ | Web: http://web.morgul.net/~frodo/ | PGP Public Key: http://web.morgul.net/~frodo/mail.html
Attachment:
pgpc9DdHK30wc.pgp
Description: PGP signature