Hello guys

The following is chkrootkits's run output lines
........
...............
...................
chkdirs: nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... lo: not promisc and no packet sniffer sockets
eth0: PACKET SNIFFER(/sbin/dhclient3[2956])
Checking `w55808'... not infected
Checking `wted'... chkwtmp: nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... user usr1 deleted or never logged from lastlog!
usr1@njac:~$

Can you comment on the following:

What is this emphasized line about eth0 ?

What is this about 'usr1' being deleted (last line)

Arye

See if you can validate the dhclient3 program. And check the logs for this usr1 user.

I don't know if dhclient operates in promiscuous mode after receiving an IP address from the DHCP server. You will want to read "/usr/share/doc/chkrootkit/README.FALSE-POSITIVES" if it exists. I've found many posts about false positives for dhclient3 because it is a program that legitimately operates in promiscuous mode (sniffer mode).