Re: chkrootkit response

[Stephen <stephen.d.allen@gmail.com>]

On Tue, Feb 14, 2006 at 11:27:27PM +1100 or thereabouts, Paul Dwerryhouse wrote:
> On Tue, Feb 14, 2006 at 02:46:48AM -0500, Stephen wrote:
> > Is this a valid response or false positive ?
> > 
> > /etc/cron.daily/chkrootkit:
> > eth0: PACKET SNIFFER(/sbin/dhclient[1102])
> 
> False positive; it's because that program has your ethernet interface in
> promiscuous mode. For dhclient, this is completely normal, it needs to
> do this to function correctly.

Thanks Paul.

-- 
Regards
Stephen
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Familiarity breeds contempt -- and children.
		-- Mark Twain
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++