[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: does chkrootkit properly detect a promisc interface?

Incoming from Jordan Lederman:
> While doing some normal system maintenance on a box of mine that primarily 
> runs snort as an ids, I ran chkrootkit which ran cleanly, reporting nothing 
> out of the ordinary. Normally this is a good thing, but then I got to 
> thinking that if I am running snort, than I am in promiscuous mode and 
> chkrootkit should report so. So, what I've found is:

There was a great hullabaloo on chkrootkit-users about two weeks ago
regarding this.  You should sheck the mailing list archives:


Any technology distinguishable from magic is insufficiently advanced.
(*)               http://www.spots.ab.ca/~keeling 
- -

Reply to: