Promiscuous
 

Hi all,
I'm running RH 7.3, on an 1850R w/ 2 nics, using snortsnarf.
eth0 is my sniffer in Promiscuous mode.
I also set eth1 also to Promisc, which is connected to the internal/external net and not a good idea to be in promisc mode.
I turned it off, "ifconfig eth1 -promisc" but it seems to reactivate on it's own. I check the /var/log/messages and see it.
Any ideas?
Thanks,
J

3 possibilities AFAIK:
- you're running Snort w/o the "-p" flag or another app like tcpdump,
- grep /etc/sysconfg/network-scripts/ifcfg-eth? -e "PROMISC", if it says PROMISC="yes" you know what to change,
- there's another sniffer installed by someone else.