In the generated log, I sometimes get a duplicate line from ifpromisc.

For instance, /var/log/chkrootkit/log.expected contains

WARNING: Output from ifpromisc:
lo: not promisc and no packet sniffer sockets
<interface>: PACKET SNIFFER([systemd-networkd|dhclient|dhcpd|dhcpcd|wpa_supplicant|NetworkManager]{PID})

But /var/log/chkrootkit/log.today currently has a duplicate line:

WARNING: Output from ifpromisc:
lo: not promisc and no packet sniffer sockets
<interface>: PACKET SNIFFER([systemd-networkd|dhclient|dhcpd|dhcpcd|wpa_supplicant|NetworkManager]{PID})
<interface>: PACKET SNIFFER([systemd-networkd|dhclient|dhcpd|dhcpcd|wpa_supplicant|NetworkManager]{PID})

which has the effect to generate an alert.

This is actually due to the filter in /etc/chkrootkit/chkrootkit.conf,
which obfuscates the output.

The unfiltered output:

lo: not promisc and no packet sniffer sockets
eth0: PACKET SNIFFER(/usr/sbin/NetworkManager[1261])
wlp0s20f3: PACKET SNIFFER(/usr/sbin/NetworkManager[1261], /usr/sbin/wpa_supplicant[1263])

But for a laptop, there is not always an Ethernet cable plugged in.

IMHO, known packet sniffers should be filtered out.

I agree that you should be able to filter out duplicate lines. And i think
this is possible with a  custom filter.


I dont think it should be the default - most chkrootkit users have a more
static network setup, and the alert shows something has changed. For
laptops where networking is more dynamic it's hard to design something that
works for everyone without also hiding information for other people.

I think the defaults need to be conservative, while allowing people to hide
what they want.

Maybe the best solution is to provide more docs/examples about how to hide
duplicate lines.

Yes, but "sed" may not be the best tool for that. With sed, removing
lines containing only the usual network managers is easier.

If they have a static network setup, why hiding the interface name?
Doing that makes the output more confusing, and the replacement of
an interface by another one would not be detected.

But are lines containing *only* the usual network managers suspicious?

you dont have to use sed, you can set anything. id use awk or sort.
but then you dont know if things have disappeared.

i believe this was because if you have multiple interfaces they may not
have static names (in the days where these were eth0 vs eth1 ) and because
eg dhcpcd was set up to listen on eth0 and wlan0 even if eth0 wasnt used.
maybe some of these assumptions are out of date?

Doing that makes the output more confusing, and the replacement of


no, but it is suspicious is anything changed.

Please also see the manpage which tells you how to use -s to remove these
lines. The config file can easily be used to use -s each time.

Using sort is not possible here, as the whole file would be sorted.

which can already happen with the default filter, because the actual
list is replaced by
  systemd-networkd|dhclient|dhcpd|dhcpcd|wpa_supplicant|NetworkManager

The default filter is either doing too little or doing too much.

AFAIK, systemd uses more complex names for predictability/stability.
For instance, on one of my machines, I have "enp0s25". See

https://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/

Alternatively, users can define "persistent net" udev rules, such as
giving the interface name based on the MAC address of the interface:

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="<MAC address>", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

With the default filter, it will not detect all changes.

IMHO, either only the PID should be hidden (this is typically the
only thing that changes in static network setups) or the usual
network managers should entirely be ignored, such as with...

Yes, I think that -s is the best solution for a laptop, but there
are issues in the man page. I've just reported bug 1070231.

That's a valid opinion, but there is no default that will pleases
anyone. the current setting has
been there for some years and works for the still-not-uncommon case
that you have both
wifi and ethernet with standard network managers -- which may appear
with changing pid and
in a different order on a reboot.

I have not seen a better "alternative default" proposed, and it is
easy to change the default,
so i think the bar for making a change has not been reached.

So i am tending to the view to close this bug

I don't see why both wifi and ethernet would be useful, except
to handle the case where ethernet is not always present (mainly
for a laptop), which is precisely this bug.

If you do not care about the interface names and known managers,
then it is useless to break this case.

But if this test is important, there is no way to require that
there should be one among two possible outputs.