I have installed the latest version of OSSEC HIDS (2.8.1), and I keep now getting these email notifications from it:
OSSEC HIDS Notification.
2015 Apr 08 11:26:17
Received From: Bath-Towel->/var/log/syslog
Rule: 5104 fired (level 8) -> "Interface entered in promiscuous(sniffing) mode."
Portion of the log(s):
Apr 8 11:26:15 Bath-Towel kernel: [ 93.311372] device eth0 entered promiscuous mode
--END OF NOTIFICATION
OSSEC HIDS Notification.
2015 Apr 08 11:26:19
Received From: Bath-Towel->/var/log/syslog
Rule: 5104 fired (level 8) -> "Interface entered in promiscuous(sniffing) mode."
Portion of the log(s):
Apr 8 11:26:18 Bath-Towel kernel: [ 95.824941] device eth0 entered promiscuous mode
--END OF NOTIFICATION
OSSEC HIDS Notification.
2015 Apr 08 11:26:23
Received From: Bath-Towel->/var/log/syslog
Rule: 5104 fired (level 8) -> "Interface entered in promiscuous(sniffing) mode."
Portion of the log(s):
Apr 8 11:26:21 Bath-Towel kernel: [ 99.353199] device eth0 entered promiscuous mode
--END OF NOTIFICATION
So what does this mean and should I be worried about it?
OS Information:
Description: Ubuntu 14.10
Release: 14.10
apt-cache policy wireshark tcpdump