rkhunter & promisc. broadcast on NIC

[Basher52]

I just saw this on my eth0 NIC:

Code: Select all

--------------------- Start Rootkit Hunter Update ---------------------
[ Rootkit Hunter version 1.3.8 ]

Checking rkhunter data files...
  Checking file mirrors.dat                                  [ No update ]
  Checking file programs_bad.dat                             [ No update ]
  Checking file backdoorports.dat                            [ No update ]
  Checking file suspscan.dat                                 [ No update ]
  Checking file i18n/cn                                      [ No update ]
  Checking file i18n/de                                      [ No update ]
  Checking file i18n/en                                      [ No update ]
  Checking file i18n/zh                                      [ No update ]
  Checking file i18n/zh.utf8                                 [ No update ]

---------------------- Start Rootkit Hunter Scan ----------------------
Warning: Possible promiscuous interfaces:
         'ifconfig' command output:
             eth0      Link encap:Ethernet  HWaddr 00:19:66:05:C8:ED 
                       UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
         'ip' command output:
             eth0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000

----------------------- End Rootkit Hunter Scan -----------------------


What does this mean?
Do I got a rootkit on it?

[Void Main]

I'm pretty sure it means you have rkhunter installed.

[Basher52]

hehe good answer, but it is that application that makes it promiscuous?
promiscuous for me sounds not good

[Void Main]

Are you running anything that would have the interface open in promiscuous mode? i.e. snort, tcpdump, wireshark, some network monitoring/statistics app?

[Basher52]

Well now when you ask, I remembered that I used tcpdump for a while

[X11]

Promiscous mode just means your network card can 'listen in,' you are worried about nothing.

[Basher52]

Well, I just wanna be sure that's no one was poking around