Re: chkrootkit response
On Tue, Feb 14, 2006 at 11:27:27PM +1100 or thereabouts, Paul Dwerryhouse wrote:
> On Tue, Feb 14, 2006 at 02:46:48AM -0500, Stephen wrote:
> > Is this a valid response or false positive ?
> > /etc/cron.daily/chkrootkit:
> > eth0: PACKET SNIFFER(/sbin/dhclient)
> False positive; it's because that program has your ethernet interface in
> promiscuous mode. For dhclient, this is completely normal, it needs to
> do this to function correctly.
Familiarity breeds contempt -- and children.
-- Mark Twain