Since updating to Debian 9, I've been getting an update every day from chkrootkit on my server about systemd-networkd being a packet sniffer. if using ifpromisc directly, I get the following:

%>  sudo /usr/lib/chkrootkit/ifpromisc               
[sudo] password for ...
lo: not promisc and no packet sniffer sockets
eth0: PACKET SNIFFER(/lib/systemd/systemd-networkd[416])
eth0: PACKET SNIFFER(/lib/systemd/systemd-networkd[416])

With the mention of promisc, I checked ip, and eth0 is not in promisc mode either:

%>  ip l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN mode DEFAULT group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 04:01:37:1a:4c:01 brd ff:ff:ff:ff:ff:ff

So firstly, is this likely to be a false alert, or something more serious? Does networkd need to do something that could be picked up as like a packet sniffer? I dont know much about how either packet sniffers, or networkd work so I'm not sure what to make of these alerts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.