Function classify_raw_socket 

pub fn classify_raw_socket(
    comm: &str,
    socket_type: &str,
    is_promiscuous: bool,
) -> bool

Classify whether a raw socket is suspicious.

Promiscuous sockets are always suspicious. AF_PACKET sockets owned by non-standard utilities are flagged.