Since updating to Debian 9, I've been getting an update every day from chkrootkit on my server about systemd-networkd being a packet sniffer. if using ifpromisc directly, I get the following:
%> sudo /usr/lib/chkrootkit/ifpromisc [sudo] password for ... lo: not promisc and no packet sniffer sockets eth0: PACKET SNIFFER(/lib/systemd/systemd-networkd) eth0: PACKET SNIFFER(/lib/systemd/systemd-networkd)
With the mention of promisc, I checked
ip, and eth0 is not in promisc mode either:
%> ip l 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN mode DEFAULT group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000 link/ether 04:01:37:1a:4c:01 brd ff:ff:ff:ff:ff:ff
So firstly, is this likely to be a false alert, or something more serious? Does networkd need to do something that could be picked up as like a packet sniffer? I dont know much about how either packet sniffers, or networkd work so I'm not sure what to make of these alerts.