[LARTC] PROMISC mode

[LARTC] PROMISC mode

[Vanitha]

[-- Attachment #1: Type: text/plain, Size: 205 bytes --]

Hello All,

While implementing CBQ for my network card ,
i found it has PROMISC  mode enabled by default while installing RedHat-7.3 .
What is it ? Is any way related to security.

Regards
Vanitha

[-- Attachment #2: Type: text/html, Size: 830 bytes --]

Re: [LARTC] PROMISC mode

[Stef Coene]

On Saturday 06 July 2002 18:07, Vanitha wrote:
> Hello All,
>
> While implementing CBQ for my network card ,
> i found it has PROMISC  mode enabled by default while installing RedHat-7.3
> . What is it ? Is any way related to security.
No.  It means the network card is capturing all packets that pass the wire.  
If you run tcpdump or other sniffing software (ntop), the network card goes 
in promiscuous mode.

Stef

-- 

stef.coene@docum.org
 "Using Linux as bandwidth manager"
     http://www.docum.org/
     #lartc @ irc.openprojects.net
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

[LARTC] promisc mode

[Ethy H. Brito]

Hi

Does somebody knows how to put (and return from) a NIC card in promiscous
mode using "ip" (iproute2)? 

Ethy H. Brito         /"\
InterNexo Ltda.       \ /  CAMPANHA DA FITA ASCII - CONTRA MAIL HTML
(012) 341-6860         X   ASCII RIBBON CAMPAIGN - AGAINST HTML MAIL
Sao Jose dos Campos   / \

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] promisc mode

[Martin A. Brown]

Hello Ethy,

# ip link set dev eth1 promisc on
# ip link set dev eth1 promisc off

  http://plorf.net/linux-ip/html/tools-ip-link.htm#TOOLS-IP-LINK-SET

-Martin

 : Does somebody knows how to put (and return from) a NIC card in promiscous
 : mode using "ip" (iproute2)? 

-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com



_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] promisc mode

[Ethy H. Brito]

On Tue, 19 Nov 2002, Martin A. Brown wrote:

> Hello Ethy,

Greetings!

> 
> # ip link set dev eth1 promisc on
> # ip link set dev eth1 promisc off
> 
>   http://plorf.net/linux-ip/html/tools-ip-link.htm#TOOLS-IP-LINK-SET

Take a look:

# ip link set dev eth0 promisc off
Error: either "dev" is duplicate, or "promisc" is a garbage.
#

I'm using iproute2-2.4.7-now-ss020116-try

Also "ip link set help" doesn't mention the word "promisc"

Any other suggestion?

> 
> -Martin
> 
>  : Does somebody knows how to put (and return from) a NIC card in promiscous
>  : mode using "ip" (iproute2)? 
> 

Ethy H. Brito         /"\
InterNexo Ltda.       \ /  CAMPANHA DA FITA ASCII - CONTRA MAIL HTML
Sao Jose dos Campos   / \

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] promisc mode

[Martin A. Brown]

My recommendation:

 : > # ip link set dev eth1 promisc on
 : > # ip link set dev eth1 promisc off
 : >   http://plorf.net/linux-ip/html/tools-ip-link.htm#TOOLS-IP-LINK-SET

Fails:

 : Take a look:
 : # ip link set dev eth0 promisc off
 : Error: either "dev" is duplicate, or "promisc" is a garbage.
 : I'm using iproute2-2.4.7-now-ss020116-try
 : Also "ip link set help" doesn't mention the word "promisc"
 : Any other suggestion?

Anybody able to comment on whether this is related to a newer version of 
iproute2 than the one I have?  I can't help much more here, since all the 
machine I have available run this command just fine.

-Martin

-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] promisc mode

[Cristian Ionescu-Idbohrn]

On Tue, 19 Nov 2002, Ethy H. Brito wrote:

> Does somebody knows how to put (and return from) a NIC card in promiscous
> mode using "ip" (iproute2)?

ip from the latest stable iproute2-2.4.7-now-ss010824 doesn't seem to
be able to do that. It can do other things like:

  # ip link set eth0 multicast off

but not:

  # ip link set eth0 promisc off

(as one would expect it to).

You'll have to use:

  # ifconfig eth0 promisc
  # ifconfig eth0 -promisc

instead.


Cheers,
Cristian

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] promisc mode

[Ethy H. Brito]

On Wed, 20 Nov 2002, Cristian Ionescu-Idbohrn wrote:

> ip from the latest stable iproute2-2.4.7-now-ss010824 doesn't seem to
> be able to do that. It can do other things like:
> 
>   # ip link set eth0 multicast off
> 
> but not:
> 
>   # ip link set eth0 promisc off
> 
> (as one would expect it to).

As I already mentioned too!

> You'll have to use:
> 
>   # ifconfig eth0 promisc
>   # ifconfig eth0 -promisc

That's my problem. "ifconfig eth0 -promisc" doesn't take the card from
promiscuous mode. (Don't ask why. I really do not know.).
The problem starts when I execute tcpdump with -p (not to promisc)
parameter. The card driver seems not be respecting that and enters promisc
anyway. It only leaves promisc mode if I run tcpdump again entering
promisc mode (without -p).
I was in hope that 'ip' could do that to me (take it from promisc mode).

I read some email in this thread about some iproute2 version executing
'promisc off'. What version could that be? A beta release?

Ethy H. Brito         /"\
InterNexo Ltda.       \ /  CAMPANHA DA FITA ASCII - CONTRA MAIL HTML
(012) 341-6860         X   ASCII RIBBON CAMPAIGN - AGAINST HTML MAIL
Sao Jose dos Campos   / \


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/