LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 04-29-2009, 02:00 AM   #1
vinnie_vinodh
Member
 
Registered: Dec 2008
Location: India
Distribution: Fedora 10
Posts: 100

Rep: Reputation: 15
Question rkhunter warnings on "possible promiscuous interface" and file properties checks


Hello
Recently i ran rkhunter after an update on my F10 and got couple of warnings of file properties checks and primarily " promiscuous interface warning"..After googling for a while i came to know that the update has caused the warnings on file properties checks .But I cant find anything relevant to promiscuous interface warnings..

This is the warning i got
>>>>Performing checks on the network interfaces
[17:25:24] Info: Starting test name 'promisc'
[17:25:24] Checking for promiscuous interfaces [ Warning ]
[17:25:24] Warning: Possible promiscuous interfaces:
[17:25:24] 'ifconfig' command output: UP BROADCAST RUNNING PROMISC MULTICAST


>>>>>What does this warning indicate ?Are these warning serious? How To rectify them? Any help would be appreciated...

Thanks In Advance To all
 
Old 04-29-2009, 02:44 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,354
Blog Entries: 55

Rep: Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541
Quote:
Originally Posted by vinnie_vinodh View Post
Recently i ran rkhunter after an update on my F10
I hope you run 1.3.4 because that's the current version?


Quote:
Originally Posted by vinnie_vinodh View Post
got couple of warnings of file properties checks and primarily " promiscuous interface warning"..After googling for a while i came to know that the update has caused the warnings on file properties checks .
Verifying changes are legitimate then running 'rkhunter --propupd' should make RKH update its database.


Quote:
Originally Posted by vinnie_vinodh View Post
But I cant find anything relevant to promiscuous interface warnings..
Running RKH it clearly says if you've got questions that can't be solved by reading the docs or the FAQ you should check the rkhunter-users mailing list and archive at Sourceforge.


Quote:
Originally Posted by vinnie_vinodh View Post
[17:25:24] 'ifconfig' command output: UP BROADCAST RUNNING PROMISC MULTICAST
>>>>>What does this warning indicate ?Are these warning serious? How To rectify them? Any help would be appreciated...
It indicates a network device has entered promiscuous mode. Promiscuous mode means the network device will be able to see traffic that's not destined for it. Applications may use packet capturing for finding "bad" traffic or traffic statistics.

Running Chkrootkit's 'ifpromisc' (caveat emptor) or these commands from root's Bash shell might give more insight:
Code:
INODES=($(grep /proc/net/packet -ve ^sk|awk '{print $9}'));
INODES=${INODES[*]}; INODES=${INODES// /|}; INODES="(${INODES})";
/usr/sbin/lsof -P -w -n -d 1-20 | egrep "${INODES}.c" | awk '{print $2}' | xargs -iX /usr/bin/readlink -f /proc/'X'/exe

Last edited by unSpawn; 04-29-2009 at 02:49 AM. Reason: code
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
how can I "cat" or "grep" a file to ignore lines starting with "#" ??? callagga Linux - Newbie 7 08-16-2013 06:58 AM
Confusing RKHunter log warnings for file properties checks jamiehh Linux - Security 8 04-15-2009 02:17 PM
IPTABLES: interface on "192.168.1.0/24" won't route clients from "10.65.0.0" zivota Linux - Networking 2 06-09-2008 01:35 PM
rkhunter: "/usr/bin/rpm warning"?!!! odiseo77 Linux - Security 8 11-05-2007 10:54 AM
file format why difference between "command line and GUI interface" hocheetiong Linux - Newbie 3 09-17-2007 07:19 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 04:19 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration