A network interface is running in promiscuous mode
What this means
‹interface› is in promiscuous mode — it's capturing all traffic on its network segment, not just traffic addressed to this host. This is the defining behavior of a packet sniffer, and is exactly what chkrootkit's own “sniffer” test checks for. Bridge ports are excluded: the kernel makes every bridge-enslaved interface promiscuous by design, so a Docker/VM veth being promiscuous means nothing. This interface is not one of those.
How to fix it
Run ip -d link show ‹interface› and check ps aux for a legitimate reason (tcpdump, Wireshark/tshark). If nothing legitimate explains it, treat this as active traffic interception and investigate immediately.
Check it yourself
Run a scan and look for BLWK-ROOTKIT-001 in the results:
bulwark scanInstalled the standalone CLI package instead of the app? The command is bulwarkctl.
How Bulwark decides
Bulwark reads network_interfaces and reports this check when:
promiscuous == true and bridge_port == falseIf a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.
References
Related checks
- Shell history recording is suppressed ·
BLWK-EVASION-001 - File modified since baseline: ‹path› ·
BLWK-FIM-001 - File deleted since baseline: ‹path› ·
BLWK-FIM-002 - Not covered by the file-integrity baseline: ‹path› ·
BLWK-FIM-003 - Credential file modified since baseline: ‹path› ·
BLWK-FIM-004 - Credential file deleted since baseline: ‹path› ·
BLWK-FIM-005