PDA

View Full Version : Wierd output from rkhunter and chkrootkit


Pugwash
September 10th, 2007, 08:55 AM
Hi,

I've noticed some wierd stuff from rkhunter and chkrootkit. In /var/mail I get the follwing message from rkhunter:


Scanning for packet capturing applications... [ Warning! ]
Warning! Found packet capturing application. Please check the logfile.
Scanning for hidden files... [ Warning! ]
-----------------------------------------------------------------

Found warnings:
[07:38:24] Checking for packet capturing applications... Warning
[07:38:25] Warning! Process /sbin/dhclient3 (3847) listening

In rkhunter.log I get this

[07:38:24] Checking for packet capturing applications... Warning
[07:38:25] Warning! Process /sbin/dhclient3 (3847) listening

I also get this from chkrootkit:

Checking `sniffer'... lo: not promisc and no packet sniffer sockets
eth0: PACKET SNIFFER(/sbin/dhclient3[3847])

I'm a bit worried here, is this normal?

dreadlord_chris
September 10th, 2007, 09:32 AM
Those are normal - that's the DHCP client... I'm assuming your computer has a dynamic IP right?

Pugwash
September 11th, 2007, 03:21 PM
Those are normal - that's the DHCP client... I'm assuming your computer has a dynamic IP right?

That's a relief, thanks. Yes, I'm using DHCP to connect to my router.