what does this mean??

eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
tcpdump: eth0: Setting promiscuous mode.
parse error
device eth0 left promiscuous mode
root@Lyris~# Sep 16 19:45:49 Lyris kernel: eth0: Setting promiscuous mode.
Sep 16 19:45:49 Lyris kernel: device eth0 entered promiscuous mode
Sep 16 19:45:49 Lyris kernel: eth0: Setting promiscuous mode.
Sep 16 19:45:49 Lyris kernel: device eth0 left promiscuous mode

A little more information would help.

What distro and kernel version are you using?

What model of NIC do you have, and what module is it using?

Had the system been functioning correctly before you started getting the error?

Did you add/upgrade any software just prior to this happening?

Well it is self compiled linux running 2.47 kernel and networked with 2 3com nics (3Com PCI 3c905 Boomerang 100baseTx) and ( 3Com PCI 3c905C Tornado) using module 3c59x for both...

I don't think they are errors, yet they keep poping up on the console.

Any idea !!!

Actually, you're right. Messages is probably a better word than errors.
So these aren't bootup messages, but messages that just appear periodically on the console?

I don't have any direct experience with this, but I'll put a couple of ideas out here anyway:

How often does this happen? Does it seem random? When did it start happening?

Are you running any processes that might be doing this? Check your running processes by doing "ps -aux|more" and look for a likely suspect.

Are you running a packet sniffer on your network? That would toggle a NIC into promiscuous mode. For that matter, if your network been compromised, someone else may be running a packet sniffer on your machine.

Try a Google search using the console messages, or parts of them, as your search criteria.

I sounds like you are getting these messages on your console because syslog isn't running or isn't set to put these messages in /dev/null or a file.

ps aux | grep syslog to make sure it's running

you may need to add
*.info;mail.none;authpriv.none

Well,

I noticed everytime I use "tcpdump" I see it again, but not sure what they mean or if they appear on their own every now and then.

I don't know if they have to do particulary with "tcpdump" or a result of an error somewhere.
syslogd is runnning OK.

tcpdump isn't responsible for the messages, it's just reporting them. I'll ask again:

- Have you checked your processes (ps -aux|more), and is anything running which might be toggling promisc mode on/off?

- When did the messages start to appear, and had you modified your system prior to that?

The promiscuous mode is a mode set for your nic card. On normal mode, the cards interprets packets only when is own MAC adress is solicitate, all other paquets on the network are discard. The promiscuous mode is used by protocol analyser, the card pass every packet on the net the third layer and so on to the application layer for software application.
In my believe, you must have installed a packet sniffer on your machine...
I think that you can turn it off, with modprobe, do man modprode and you can find the switch to turn off promiscuous mode.

Sorry, not modprope but ifconfig obviously the swith is -promisc
good luck

sorry,
I have not had much time to look into it, but I will try your suggestion....
Thanks.

Just to update:

After a little more research, I've found the following:

A review of /var/log/messages on my machine showed that a script (/usr/share/msec/promisc_check.sh) was being fired off as a cron job. Although it never printed messages to my screen, you might want to check it out.

BTW- I'm using Mandrake 8; the location of this script may be different in your distro.

Hi


Actually there is no problem in any of ur configurations..


tcpdump is a sniffer utility. whenever u run tcpdump the nic card will go to promiscuous mode to collect all the pactest moving in the wire. if u stop it the card will work in normal mode.


siddiqu.T