Re: ifconfig doesn't report Promiscuous interfaces

[Noah L. Meyerhans]

On Sat, Mar 17, 2001 at 12:32:03AM -0500, S . Salman Ahmed wrote:
> 
> Any other ways I can try and detect this rootkit on my systems ?
> 

Knark can't function if you have disabled module loading.  It is a
module, so it can't do anything if it can't be run.

Did you say that the kernel logs a message about switching to/from
promisc mode if you do an 'ifconfig promisc' or 'ifconfig -promisc'?

noah

-- 
 _______________________________________________________
| Web: http://web.morgul.net/~frodo/
| PGP Public Key: http://web.morgul.net/~frodo/mail.html 

PGP signature