Re: Interface promiscuity obscurity in Linux

From: Paul Starzetz (paulat_private)
Date: Thu Jul 25 2002 - 02:39:09 PDT

Next message: Glynn Clements: "Re: Interface promiscuity obscurity in Linux"

Previous message: TLR@portcullis-security.com: "VU#197395 Microsoft IIS SMTP encapsulated e-mail address vulnerability - update"
In reply to: Ricardo Branco: "Interface promiscuity obscurity in Linux"
Next in thread: Glynn Clements: "Re: Interface promiscuity obscurity in Linux"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Ricardo Branco wrote:

>This affects Linux 2.2 and 2.4
>
>Using libpcap to put the interface in promiscuous mode, will cause that
>ifconfig(8) doesn't show it!
>  
>
This is an old issue (noticed this nearly 2 years ago...) but can be 
contributed to 'bad' userspace tools.

>libpcap uses setsockopt(..., SOL_PACKET, PACKET_ADD_MEMBERSHIP, ...) with
>PACKET_MR_PROMISC to set the interface in promiscuous mode.
>  
>
The interesting thing is that the PF_PACKET sockets are also not 
reported by netstat. Anyway this should be fixed.

/ih

Next message: Glynn Clements: "Re: Interface promiscuity obscurity in Linux"
Previous message: TLR@portcullis-security.com: "VU#197395 Microsoft IIS SMTP encapsulated e-mail address vulnerability - update"
In reply to: Ricardo Branco: "Interface promiscuity obscurity in Linux"
Next in thread: Glynn Clements: "Re: Interface promiscuity obscurity in Linux"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Jul 25 2002 - 10:07:38 PDT