Hi. I ran chkrootkit on my debian image and one line had the output:

Checking `sniffer'... lo: not promisc and no packet sniffer sockets
eth0: PACKET SNIFFER(/sbin/dhclient-2.2.x (deleted)[105])

Is it normal for dhclient to be detected as root kit or has mine been infected somehow! ?

_________________
Visit http://www.doc2pdf.net for a free, no-need-to-register .doc to .pdf converter.

dhclient does set some socket options which chkrootkit might detect as sniffing. Basically, dhclient needs to accept any traffic, because it runs before the interface has an IP. That's my guess, at least, sorry for the non-confidence inspiring lack of technical details.

Could you deploy a fresh Debian install (only needs 80 megs or so), and run chkrootkit against it? I'd guess you'd get the same result. Googling turned up similar results as yours for Slackware, and some other distros...

-Chris

Yes, I think I have a spare room on my linode for that. Do I need another IP to be able to access the other one with ssh?

_________________
Visit http://www.doc2pdf.net for a free, no-need-to-register .doc to .pdf converter.

It is due to dhclient....caker's descriptio is exactly correct.

_________________
--Matt Cowger

Ok, thanks alot guys!

_________________
Visit http://www.doc2pdf.net for a free, no-need-to-register .doc to .pdf converter.

I know this topic's been dealt with, but for future reference...



I believe that only one profile can be up at a time, even if you do have more than one IP. I could be wrong on that, but from what I've seen that's how it works.