Re: does chkrootkit properly detect a promisc interface?
Incoming from Jordan Lederman:
> While doing some normal system maintenance on a box of mine that primarily
> runs snort as an ids, I ran chkrootkit which ran cleanly, reporting nothing
> out of the ordinary. Normally this is a good thing, but then I got to
> thinking that if I am running snort, than I am in promiscuous mode and
> chkrootkit should report so. So, what I've found is:
There was a great hullabaloo on chkrootkit-users about two weeks ago
regarding this. You should sheck the mailing list archives:
Any technology distinguishable from magic is insufficiently advanced.