LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 10-03-2005, 04:56 AM   #1
hardian_97
LQ Newbie
 
Registered: Jul 2005
Location: Indonesia
Posts: 23

Rep: Reputation: 15
etho toggleing promiscuous mode


Hi all,

I checked my server using dmesg command and I found this message:
.
.
.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
.
.
.

It is toggling all the time. It doesn't effect to network performance though. I tried to googled this problem and it was said that some sniffer program can caused this, such as tcpdump. But, I couldn't see any tcpdump running. I did using it before but not anymore.

Do you know how to find out which program that causing this eth0 toggling between entering and leaving promiscuous mode?

Thanks for your time and I'd appreciate your respond.

With kind regards,
Hardian
Jr. System Engineer
 
Old 10-03-2005, 09:21 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,394
Blog Entries: 55

Rep: Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565Reputation: 3565
- make sure /var/log/messages is the log the messages arrive in, else choose other log,
- install latest Chkrootkit(.org), run chkrootkit to be on the safe side, find location of "ifpromisc" binary
then as root run:
Code:
tail -f /var/log/messages|grep -qie "promisc" &&  /path/to/ifpromisc
It will die after the first hit and show a message "interface_name: PF_PACKET(/path/name)"
where "/path/name" is a binary who puts the interface in promisc mode.
 
Old 03-28-2006, 11:49 AM   #3
JakeX
Member
 
Registered: Aug 2004
Location: Windsor Ontario
Distribution: Ubuntu, Debian, Redhat
Posts: 44

Rep: Reputation: 15
I'm also plauged with this promisc mode on my eth0, I'll try the above mentioned. As I've ran chkrootkit scans and all come back negative, firewall is fine... device keeps going promisc, and I haven't used tcpdump on there :|
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Iptables in promiscuous mode Barzan Linux - Networking 3 10-23-2005 08:24 AM
Promiscuous Mode: Yes or No? AvatarofVirgo Linux - Security 3 02-22-2005 08:22 PM
promiscuous mode question zsoltrenyi Linux - Networking 2 01-25-2005 06:57 AM
How Do I switch to promiscuous mode? 0din Linux - Newbie 1 03-05-2004 01:34 PM
eth0 promiscuous mode susx Linux - Networking 11 09-22-2001 01:39 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 02:23 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration