[SOLVED] A sniffer in a WPA Supplicant.

[mika]

Hi!

The chkrootkit -program gave the following output:

Code: Select all

Checking `sniffer'... wlo1: PF_PACKET(/usr/sbin/wpa_supplicant)

Most likely, this is a false positive. But how can I make sure it?

regards Mika

[doktor5000]

Simply google for it and crosscheck from various sources. It's simply a false positive:
https://bugs.debian.org/cgi-bin/bugrepo ... bug=630880

[mika]

I checked the sha256sum of the /usr/sbin/wpa_supplicant -file and its counterpart from the original RPM.
Checksums matched, so the problem doesn't exist.

P.S.
If one has a similar case you can extract a RPM without installing it using:

Code: Select all

rpm2cpio wpa_supplicant-2.0-2.mga4.x86_64.rpm | cpio -idmv

So long!

[doktor5000]

You could just run

Code: Select all

rpm -V wpa_supplicant

to check if the checksums from all files match with those from the rpm.