Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After a download yesterday my computer crashed. I updated today and checked for rootkits. I found a packet sniffer

eth0: PACKET SNIFFER(/sbin/dhclient[3966])

How can I remove this?

share|improve this question
How did you check for rootkits? – Mitch May 31 '12 at 10:13
sudo chkrootkit – Wes May 31 '12 at 10:15
up vote 4 down vote accepted

I think it might be a false positive. Try checking with rkhunter, because it gives fewer false positives. To download rkhunter, and for more detailed info on how to use it, See this site

If it come up clean, then you have reason for concern.

Try this as well:

  1. rkhunter --check

  2. update

  3. sudo rkhunter --propupd

  4. rkhunter --check

Source: The Rootkit Hunter project

share|improve this answer
Checked with the rkhunter -c command and had one warning: /usr/bin/unhide.rb [ Warning ] – Wes May 31 '12 at 10:40
Checking for passwd file changes [ Warning ] Checking for group file changes [ Warning ] Checking for hidden files and directories [ Warning ] – Wes May 31 '12 at 10:54
Mitch: Did all things listed above. Found one file that is replaced by a script and is not whitelisted Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: /usr/bin/unhide.rb: Ruby script, ASCII Should I worry? Thanks for all you time, Wes – Wes May 31 '12 at 11:46
rkhunter is informing you the unhide.rb executable located in /usr/bin/ is a ruby script. It is perfectly normal in that case and you can white-list it in rkhunter.conf – Mitch May 31 '12 at 11:49
Well, the unide thing is different. - – James May 31 '12 at 11:57

Dhclient is the standard " Dynamic Host Configuration Protocol Client" for Ubuntu that is needed for when you have not a fixed IP but still want to be reachable from the Internet.

In case you are worried you should check your dhclient.conf for unwanted entries.

share|improve this answer
Checked the dhclient.conf file. Nothing is added. – Wes May 31 '12 at 11:48
@Wes use apt-get download isc-dhcp-client to download a fresh deb, extract the package and replace your existing /sbin/dhclient with the newly downloaded one and it should fix the issue. see here… – mchid Aug 9 '14 at 20:16

The isc-dhcp-client and isc-dhcp-server packages (DHCP client and server) re-runs their daemons regularly and cause a "packet sniffer" false positive. The chkrootkit package's /etc/cron.daily/chkrootkit script has a workaround for this which tries to replaces the PID with a static string.

However, the workaround for the false positive doesn't work. This is because on Debian, the binaries from these packages used to end with a version number, e.g. /sbin/dhclient3. But the chkrootkit package maintainers never updated /etc/cron.daily/chkrootkit to work with version 4 series of the isc-dhcp-client and isc-dhcp-server packages, whose files don't have the version number.

To fix this issue, make a backup copy of /etc/cron.daily/chkrootkit then edit it and change...

sed -r -e 's,eth(0|1)(:[0-9])?: PACKET SNIFFER\((/sbin/dhclient3|/usr/sbin/dhcpd3)\[[0-9]+\]\),eth\[0|1\]: PACKET SNIFFER\([dhclient3|dhcpd3]{PID}\),' \

sed -r -e 's,eth(0|1)(:[0-9])?: PACKET SNIFFER\((/sbin/dhclient|/usr/sbin/dhcpd)\[[0-9]+\]\),eth\[0|1\]: PACKET SNIFFER\([dhclient|dhcpd]{PID}\),' \

Be careful to leave the backslash at the end of the line.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.