Re: Interface promiscuity obscurity in Linux

From: Rasmus Bøg Hansen (moffeat_private)
Date: Wed Jul 24 2002 - 16:06:02 PDT

  • Next message: plattnerat_private: "Re: Interface promiscuity obscurity in Linux"

    On Thu, 25 Jul 2002, Ricardo Branco wrote:
    
    > This affects Linux 2.2 and 2.4
    >
    > Using libpcap to put the interface in promiscuous mode, will cause that
    > ifconfig(8) doesn't show it!
    >
    > libpcap uses setsockopt(..., SOL_PACKET, PACKET_ADD_MEMBERSHIP, ...) with
    > PACKET_MR_PROMISC to set the interface in promiscuous mode.
    
    I can confirm that with 2.4.19-rc3. When using tcpdump (with libpcap),
    ifconfig does not report, that the interface is in promiscous mode:
    
    root@grignard:~# tcpdump -n -i eth0 > /dev/null &
    [1] 20101
    tcpdump: listening on eth0
    root@grignard:~# /sbin/ifconfig
    eth0      Link encap:Ethernet  HWaddr 00:90:27:A6:63:DC
              inet addr:172.16.0.130  Bcast:172.31.255.255  Mask:255.240.0.0
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:1848637 errors:0 dropped:0 overruns:0 frame:0
              TX packets:2654247 errors:0 dropped:0 overruns:0 carrier:0
              collisions:34909 txqueuelen:100
              RX bytes:231541983 (220.8 MiB)  TX bytes:3666205284 (3.4 GiB)
              Interrupt:10 Base address:0xb000
    
    lo        Link encap:Local Loopback
              inet addr:127.0.0.1  Mask:255.0.0.0
              UP LOOPBACK RUNNING  MTU:16436  Metric:1
              RX packets:101208 errors:0 dropped:0 overruns:0 frame:0
              TX packets:101208 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:0
              RX bytes:32332341 (30.8 MiB)  TX bytes:32332341 (30.8 MiB)
    
    root@grignard:~# uname -a
    Linux grignard 2.4.19-rc3 #1 lør jul 20 04:06:23 CEST 2002 i686 unknown
    root@grignard:~#
    
    tcpdump does use libpcap here, and it does set eth0 in promiscous mode:
    
    moffe@grignard:~# ldd /usr/sbin/tcpdump
            libpcap.so.0 => /usr/lib/libpcap.so.0 (0x4001e000)
            libnsl.so.1 => /lib/libnsl.so.1 (0x40039000)
            libc.so.6 => /lib/libc.so.6 (0x4004e000)
            /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
    moffe@grignard:/tmp# dpkg -l libpcap0 tcpdump net-tools
    Ønsket=Ukendt/Installér/Fjern/Udrens/Tilbagehold
    | Status=Ikke/Installeret/Opsæt.-files/Upakket/Opsætn.-fejl/Halvt-inst.
    |/ Fjl?=(ingen)/Tilbageholdt/Geninst.-krævet/X=begge-dele (Status,Fjl:
    versaler=slemt)
    ||/ Navn           Version        Beskrivelse
    +++-==============-==============-============================================
    ii  libpcap0       0.6.2-2        System interface for user-level packet captu
    ii  tcpdump        3.6.2-2.0.1    A powerful tool for network monitoring and d
    ii  net-tools      1.60-4         The NET-3 networking toolkit
    moffe@grignard:~# dmesg
    [...]
    device eth0 entered promiscuous mode
    device eth0 left promiscuous mode
    
    /Rasmus
    
    -- 
    -- [ Rasmus "Møffe" Bøg Hansen ] ---------------------------------------
    Don't you hate yourself in the morning?
    - Sleep till noon!
    ----------------------------------[ moffe at amagerkollegiet dot dk ] --
    



    This archive was generated by hypermail 2b30 : Wed Jul 24 2002 - 16:20:25 PDT