[tlug] pcap

[Tony Laszlo <laszlo@example.com>]

I got this in /var/log/messages. 
I don't see any logins or attempted 
logins before this. pcap now exists as 
a group and user. 

Right around this time I was using 
RH's up2date. One of the things 
being installed/upgraded was arpwatch. 
Could this be part of that process, 
or something more sinister? 


Apr 14 05:14:03 net groupadd[11675]: new group: name=pcap, gid=77 
Apr 14 05:14:04 net useradd[11676]: new user: name=pcap, uid=77, gid=77, 
home=/var/arpwatch, shell=/sbin/nologin