Interface in promiscous mode

Interface in promiscous mode

Post by Fra » Wed, 17 Apr 2002 02:56:16



Hi all,

I've installed a Mandrake 8.2 in my box and I concerned about an entry
that is appearing in /var/log/kernel/info file. The entry is saying
"device eth0 entered promiscuous mode".

I've not installed any kind of sniffer like ethereal or tcpdump. I've
checked all processes in my box and I've not found any that put the
interface in this state.
If I put ip show link, this is the result:
2: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast
qlen 100
    link/ether 00:00:c0:87:4b:ac brd ff:ff:ff:ff:ff:ff
Does anybody know what is happening ?
Thanks in advance.

 
 
 

Interface in promiscous mode

Post by Arro » Wed, 17 Apr 2002 13:35:04


Check to see if you have snort installed, thats what did it for me.

Arron


Quote:> Hi all,

> I've installed a Mandrake 8.2 in my box and I concerned about an entry
> that is appearing in /var/log/kernel/info file. The entry is saying
> "device eth0 entered promiscuous mode".

> I've not installed any kind of sniffer like ethereal or tcpdump. I've
> checked all processes in my box and I've not found any that put the
> interface in this state.
> If I put ip show link, this is the result:
> 2: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast
> qlen 100
>     link/ether 00:00:c0:87:4b:ac brd ff:ff:ff:ff:ff:ff
> Does anybody know what is happening ?
> Thanks in advance.


 
 
 

Interface in promiscous mode

Post by Fra » Tue, 23 Apr 2002 21:46:02


Thanks Arron.
It was another IDS ( prelude ) that puts the interface in this mode.

> Check to see if you have snort installed, thats what did it for me.

> Arron



> > Hi all,

> > I've installed a Mandrake 8.2 in my box and I concerned about an entry
> > that is appearing in /var/log/kernel/info file. The entry is saying
> > "device eth0 entered promiscuous mode".

> > I've not installed any kind of sniffer like ethereal or tcpdump. I've
> > checked all processes in my box and I've not found any that put the
> > interface in this state.
> > If I put ip show link, this is the result:
> > 2: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast
> > qlen 100
> >     link/ether 00:00:c0:87:4b:ac brd ff:ff:ff:ff:ff:ff
> > Does anybody know what is happening ?
> > Thanks in advance.