On Mon, Aug 14, 2006 at 11:09:54AM +0300, Henri Salo wrote: > Lothar Ketterer wrote: > >and chkrootkit (version 0.46a) gives me > > > >eth0: PF_PACKET(/sbin/dhclient, /usr/sbin/arpwatch) > > > >lo is not mentioned. I just checked with chkrootkit version 44-2 (sarge package): Checking `sniffer'... lo: not promisc and no packet sniffer sockets > With ifup in unstable machine: Didn't you write "stable" in your original post? Regards, Lothar