5

After a download yesterday my computer crashed. I updated today and checked for rootkits. I found a packet sniffer

eth0: PACKET SNIFFER(/sbin/dhclient[3966])

How can I remove this?

2
  • How did you check for rootkits?
    – Mitch
    May 31, 2012 at 10:13
  • 1
    sudo chkrootkit
    – Wes
    May 31, 2012 at 10:15

3 Answers 3

5

I think it might be a false positive. Try checking with rkhunter, because it gives fewer false positives. To download rkhunter, and for more detailed info on how to use it, See this site

If it come up clean, then you have reason for concern.

Try this as well:

  1. rkhunter --check

  2. update

  3. sudo rkhunter --propupd

  4. rkhunter --check

Source: The Rootkit Hunter project

6
  • Checked with the rkhunter -c command and had one warning: /usr/bin/unhide.rb [ Warning ]
    – Wes
    May 31, 2012 at 10:40
  • Checking for passwd file changes [ Warning ] Checking for group file changes [ Warning ] Checking for hidden files and directories [ Warning ]
    – Wes
    May 31, 2012 at 10:54
  • Mitch: Did all things listed above. Found one file that is replaced by a script and is not whitelisted Warning: The command '/usr/bin/unhide.rb' has been replaced by a script: /usr/bin/unhide.rb: Ruby script, ASCII Should I worry? Thanks for all you time, Wes
    – Wes
    May 31, 2012 at 11:46
  • rkhunter is informing you the unhide.rb executable located in /usr/bin/ is a ruby script. It is perfectly normal in that case and you can white-list it in rkhunter.conf
    – Mitch
    May 31, 2012 at 11:49
  • Well, the unide thing is different. - bugs.debian.org/cgi-bin/bugreport.cgi?bug=607224
    – jrg
    May 31, 2012 at 11:57
3

The isc-dhcp-client and isc-dhcp-server packages (DHCP client and server) re-runs their daemons regularly and cause a "packet sniffer" false positive. The chkrootkit package's /etc/cron.daily/chkrootkit script has a workaround for this which tries to replaces the PID with a static string.

However, the workaround for the false positive doesn't work. This is because on Debian, the binaries from these packages used to end with a version number, e.g. /sbin/dhclient3. But the chkrootkit package maintainers never updated /etc/cron.daily/chkrootkit to work with version 4 series of the isc-dhcp-client and isc-dhcp-server packages, whose files don't have the version number.

To fix this issue, make a backup copy of /etc/cron.daily/chkrootkit then edit it and change...

sed -r -e 's,eth(0|1)(:[0-9])?: PACKET SNIFFER\((/sbin/dhclient3|/usr/sbin/dhcpd3)\[[0-9]+\]\),eth\[0|1\]: PACKET SNIFFER\([dhclient3|dhcpd3]{PID}\),' \

...to...

sed -r -e 's,eth(0|1)(:[0-9])?: PACKET SNIFFER\((/sbin/dhclient|/usr/sbin/dhcpd)\[[0-9]+\]\),eth\[0|1\]: PACKET SNIFFER\([dhclient|dhcpd]{PID}\),' \

Be careful to leave the backslash at the end of the line.

2

Dhclient is the standard " Dynamic Host Configuration Protocol Client" for Ubuntu that is needed for when you have not a fixed IP but still want to be reachable from the Internet.

In case you are worried you should check your dhclient.conf for unwanted entries.

2
  • Checked the dhclient.conf file. Nothing is added.
    – Wes
    May 31, 2012 at 11:48
  • @Wes use apt-get download isc-dhcp-client to download a fresh deb, extract the package and replace your existing /sbin/dhclient with the newly downloaded one and it should fix the issue. see here askubuntu.com/questions/258658/…
    – mchid
    Aug 9, 2014 at 20:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .