Very Computer

Hi all,

I've installed a Mandrake 8.2 in my box and I concerned about an entry
that is appearing in /var/log/kernel/info file. The entry is saying
"device eth0 entered promiscuous mode".

I've not installed any kind of sniffer like ethereal or tcpdump. I've
checked all processes in my box and I've not found any that put the
interface in this state.
If I put ip show link, this is the result:
2: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast
qlen 100
    link/ether 00:00:c0:87:4b:ac brd ff:ff:ff:ff:ff:ff
Does anybody know what is happening ?
Thanks in advance.

Check to see if you have snort installed, thats what did it for me.

Arron

Quote:> Hi all,

> I've installed a Mandrake 8.2 in my box and I concerned about an entry
> that is appearing in /var/log/kernel/info file. The entry is saying
> "device eth0 entered promiscuous mode".

> I've not installed any kind of sniffer like ethereal or tcpdump. I've
> checked all processes in my box and I've not found any that put the
> interface in this state.
> If I put ip show link, this is the result:
> 2: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast
> qlen 100
>     link/ether 00:00:c0:87:4b:ac brd ff:ff:ff:ff:ff:ff
> Does anybody know what is happening ?
> Thanks in advance.

Thanks Arron.
It was another IDS ( prelude ) that puts the interface in this mode.