Re: does chkrootkit properly detect a promisc interface?

["s. keeling" <keeling@spots.ab.ca>]

Incoming from Jordan Lederman:
> 
> While doing some normal system maintenance on a box of mine that primarily 
> runs snort as an ids, I ran chkrootkit which ran cleanly, reporting nothing 
> out of the ordinary. Normally this is a good thing, but then I got to 
> thinking that if I am running snort, than I am in promiscuous mode and 
> chkrootkit should report so. So, what I've found is:

There was a great hullabaloo on chkrootkit-users about two weeks ago
regarding this.  You should sheck the mailing list archives:

   http://marc.theaimsgroup.com/?l=chkrootkit-users


-- 
Any technology distinguishable from magic is insufficiently advanced.
(*)               http://www.spots.ab.ca/~keeling 
- -