My network is constantly used at 8%, except when I run tcpdump, ethereal, or otherwise start using the internet and computer.

I ran chkrootkit, and while I'm in initng, it tells me that /sbin/init is infected. If I run the init old generation, it doesn't say that /sbin/init is infected...

I'm security conscious and my first idea is to compare another ubuntu machine I have, and then to reformat and reinstall (aaaaaarrrgg!!)...

Advice greatly appreciated.

I'm guessing:
8% because of lo activity, or bug in the applet
netstat returns no listening ports except on lo
tcpdump on everything and ethereal reports a few packets on lo, and nothing on ath0, eth0, sit0, and wifi0, even with interface (except lo) disabled.

initng created the false alarm because (possibly) chkrootkit is not programmed to handle a different init.
The other ubuntu machine reports that dhcpclient is promiscuous on that computer too (I've thought so).

The other thing would be my paranoia with security and computer health and performance... I need a vacation?

initng created the false alarm because (possibly) chkrootkit is not programmed to handle a different init.
If all checks out fine (minimally the md5sums on the package and the binary), I'd say mail the false positive report to the maintainer.


The other ubuntu machine reports that dhcpclient is promiscuous on that computer too
That's a known situation. If you kill dhcpclient and it's still in promisc mode and there's no other libcap app listening (use /sbin/ip instead of ifconfig) *then* investigate.

the md5 of initng the debian package is the same as the one in /sbin/initng.
*edit* I'll file a bug report... meanwhile and inside a day, a new initng just came out*/edit*
the dhcp client was killed, and no promiscuosity was reported.

That leaves pananoia... By the way, these are good methods... I'll remember those...

The "8% activity network" has been solved:
My card, perhaps being promiscuous because of the dhcp client, kept on receiving a steady flow of packets from a peer in my network that was intended for another computer outside the network...

I can rest now