LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 09-16-2001, 06:50 PM   #1
susx
LQ Newbie
 
Registered: Aug 2001
Posts: 19

Rep: Reputation: 0
eth0 promiscuous mode


what does this mean??

eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
tcpdump: eth0: Setting promiscuous mode.
parse error
device eth0 left promiscuous mode
root@Lyris~# Sep 16 19:45:49 Lyris kernel: eth0: Setting promiscuous mode.
Sep 16 19:45:49 Lyris kernel: device eth0 entered promiscuous mode
Sep 16 19:45:49 Lyris kernel: eth0: Setting promiscuous mode.
Sep 16 19:45:49 Lyris kernel: device eth0 left promiscuous mode
 
Old 09-16-2001, 07:14 PM   #2
DMR
Member
 
Registered: Jun 2001
Location: Fairfax, California
Distribution: RH 9.0, RH 7.3, Mandrake 8.0
Posts: 986

Rep: Reputation: 30
A little more information would help.

What distro and kernel version are you using?

What model of NIC do you have, and what module is it using?

Had the system been functioning correctly before you started getting the error?

Did you add/upgrade any software just prior to this happening?
 
Old 09-16-2001, 07:22 PM   #3
susx
LQ Newbie
 
Registered: Aug 2001
Posts: 19

Original Poster
Rep: Reputation: 0
Well it is self compiled linux running 2.47 kernel and networked with 2 3com nics (3Com PCI 3c905 Boomerang 100baseTx) and ( 3Com PCI 3c905C Tornado) using module 3c59x for both...

I don't think they are errors, yet they keep poping up on the console.

Any idea !!!
 
Old 09-16-2001, 08:09 PM   #4
DMR
Member
 
Registered: Jun 2001
Location: Fairfax, California
Distribution: RH 9.0, RH 7.3, Mandrake 8.0
Posts: 986

Rep: Reputation: 30
Actually, you're right. Messages is probably a better word than errors.
So these aren't bootup messages, but messages that just appear periodically on the console?

I don't have any direct experience with this, but I'll put a couple of ideas out here anyway:

How often does this happen? Does it seem random? When did it start happening?

Are you running any processes that might be doing this? Check your running processes by doing "ps -aux|more" and look for a likely suspect.

Are you running a packet sniffer on your network? That would toggle a NIC into promiscuous mode. For that matter, if your network been compromised, someone else may be running a packet sniffer on your machine.

Try a Google search using the console messages, or parts of them, as your search criteria.
 
Old 09-16-2001, 08:31 PM   #5
no2nt
Member
 
Registered: Aug 2001
Location: South Carolina, USA
Distribution: Redhat 8.0/Custom
Posts: 96

Rep: Reputation: 16
syslogd

I sounds like you are getting these messages on your console because syslog isn't running or isn't set to put these messages in /dev/null or a file.

ps aux | grep syslog to make sure it's running

you may need to add
*.info;mail.none;authpriv.none
 
Old 09-17-2001, 03:49 AM   #6
susx
LQ Newbie
 
Registered: Aug 2001
Posts: 19

Original Poster
Rep: Reputation: 0
Well,

I noticed everytime I use "tcpdump" I see it again, but not sure what they mean or if they appear on their own every now and then.

I don't know if they have to do particulary with "tcpdump" or a result of an error somewhere.
syslogd is runnning OK.
 
Old 09-17-2001, 04:12 AM   #7
DMR
Member
 
Registered: Jun 2001
Location: Fairfax, California
Distribution: RH 9.0, RH 7.3, Mandrake 8.0
Posts: 986

Rep: Reputation: 30
tcpdump isn't responsible for the messages, it's just reporting them. I'll ask again:

- Have you checked your processes (ps -aux|more), and is anything running which might be toggling promisc mode on/off?

- When did the messages start to appear, and had you modified your system prior to that?
 
Old 09-17-2001, 05:34 AM   #8
c0c0deuz
Member
 
Registered: Aug 2001
Location: Qc, Canada
Distribution: RedHat, Mandrake, FreeEOS
Posts: 336

Rep: Reputation: 30
The promiscuous mode is a mode set for your nic card. On normal mode, the cards interprets packets only when is own MAC adress is solicitate, all other paquets on the network are discard. The promiscuous mode is used by protocol analyser, the card pass every packet on the net the third layer and so on to the application layer for software application.
In my believe, you must have installed a packet sniffer on your machine...
I think that you can turn it off, with modprobe, do man modprode and you can find the switch to turn off promiscuous mode.
 
Old 09-17-2001, 10:35 AM   #9
c0c0deuz
Member
 
Registered: Aug 2001
Location: Qc, Canada
Distribution: RedHat, Mandrake, FreeEOS
Posts: 336

Rep: Reputation: 30
Sorry, not modprope but ifconfig obviously the swith is -promisc
good luck
 
Old 09-20-2001, 05:16 PM   #10
susx
LQ Newbie
 
Registered: Aug 2001
Posts: 19

Original Poster
Rep: Reputation: 0
sorry,
I have not had much time to look into it, but I will try your suggestion....
Thanks.
 
Old 09-22-2001, 12:07 AM   #11
DMR
Member
 
Registered: Jun 2001
Location: Fairfax, California
Distribution: RH 9.0, RH 7.3, Mandrake 8.0
Posts: 986

Rep: Reputation: 30
Just to update:

After a little more research, I've found the following:

A review of /var/log/messages on my machine showed that a script (/usr/share/msec/promisc_check.sh) was being fired off as a cron job. Although it never printed messages to my screen, you might want to check it out.

BTW- I'm using Mandrake 8; the location of this script may be different in your distro.

Last edited by DMR; 09-22-2001 at 12:10 AM.
 
Old 09-22-2001, 12:39 AM   #12
siddiqu
Member
 
Registered: Mar 2001
Location: India
Posts: 332

Rep: Reputation: 30

Hi


Actually there is no problem in any of ur configurations..


tcpdump is a sniffer utility. whenever u run tcpdump the nic card will go to promiscuous mode to collect all the pactest moving in the wire. if u stop it the card will work in normal mode.


siddiqu.T
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
eth0 entering promiscuous mode redhax8 Debian 4 10-18-2004 12:38 AM
eth0 promiscuous mode? emetib Linux - Networking 9 08-26-2004 06:51 PM
Eth0 : Promiscuous mode enabled singhrishi Linux - Hardware 1 10-10-2003 01:24 PM
Eth0 : Promiscuous mode enabled singhrishi Linux - Networking 0 10-10-2003 07:10 AM
Eth0 : Promiscuous mode enabled singhrishi Linux - Software 0 10-10-2003 04:23 AM


All times are GMT -5. The time now is 12:47 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration