[Bug 602734] Re: ifpromisc reports PACKET SNIFFER for /usr/sbin/dhcpd3

[Christian Reis]

I was referring to http://bugs.debian.org/cgi-
bin/bugreport.cgi?bug=525370 but now that I see it it's not exactly the
same issue.

So I think something is wrong in my cron.daily script, then, because I'm
seeing this in my email notifications. Let me check. Okay, so if
cron.daily is running its chkrootkit script as I think it should be,
then this regexp may be broken:


  # the sed expression replaces the messages about /sbin/dhclient3 /usr/sbin/dhcpd3
  # with a message that is the same whatever order eth0 and eth1 were scanned
  sed -r -e 's,eth(0|1)(:[0-9])?: PACKET SNIFFER\((/sbin/dhclient3|/usr/sbin/dhcpd3)\[[0-9]+\]\),eth\[0|1\]: PACKET SNIFFER\([dhclient3|dhcpd3]{PID}\),' \
  -e 's/(! \w+\s+)[ 0-9]{4}[0-9]/\1#####/' $LOG_DIR/log.today.raw > $LOG_DIR/log.today

Could that be the issue?


** Bug watch added: Debian Bug tracker #525370
   http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=525370

** Summary changed:

- ifpromisc reports PACKET SNIFFER for /usr/sbin/dhcpd3
+ chkrootkit daily report accuses PACKET SNIFFER for /usr/sbin/dhcpd3

-- 
chkrootkit daily report accuses PACKET SNIFFER for /usr/sbin/dhcpd3
https://bugs.launchpad.net/bugs/602734
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to chkrootkit in ubuntu.