Re: ifconfig doesn't report Promiscuous interfaces
Check out
http://members.nbci.com/dsinet/network-sniffers/interface-promiscuity-obscurity.txt
The only other thing I can think of is, something (or someone) is resetting
interface flags (not even sure if that's still possible, the article's from '98),
or there's some subtle bug in the nic's driver (what driver is this, btw?).
On Sat, Mar 17, 2001 at 12:32:03AM -0500, S.Salman Ahmed wrote:
>
> Andres,
>
> I recompiled 2.4.2 and this time I disabled all support for modules
> (CONFIG_MODULES was not set). I booted this 2.4.2 kernel, and I still
> get the same behaviour. When running either tcpdump or snort, ifconfig
> still doesn't report the interface as being Promiscuous.
>
> I found a program called knarkfinder.c that's supposed to check for the
> knark rootkit, but the one I found doesn't compile with 2.4.2.
>
> Any other ways I can try and detect this rootkit on my systems ?
>
> Thanks.
>
> --
> Salman Ahmed
> ssahmed AT pathcom DOT com
>
--
"... being a Linux user is sort of like living in a house inhabited
by a large family of carpenters and architects. Every morning when
you wake up, the house is a little different. Maybe there is a new
turret, or some walls have moved. Or perhaps someone has temporarily
removed the floor under your bed." - Unix for Dummies, 2nd Edition
-- found in the .sig of Rob Riggs, rriggs@tesser.com
Reply to: