Incoming from Jordan Lederman: > > While doing some normal system maintenance on a box of mine that primarily > runs snort as an ids, I ran chkrootkit which ran cleanly, reporting nothing > out of the ordinary. Normally this is a good thing, but then I got to > thinking that if I am running snort, than I am in promiscuous mode and > chkrootkit should report so. So, what I've found is:
There was a great hullabaloo on chkrootkit-users about two weeks ago regarding this. You should sheck the mailing list archives: http://marc.theaimsgroup.com/?l=chkrootkit-users -- Any technology distinguishable from magic is insufficiently advanced. (*) http://www.spots.ab.ca/~keeling - -
