eth0: entering promiscuous mode?

[Syngin]

Made the mistake of adding a Woody apt source earlier today and a sizable chunk of my system up dated to Woody. Everything is still ok except that, after about 20-25 minutes, an system note comes up telling me that eth0 is going into promiscuous mode.

After that, eth0 just vanishes. (this box is my gateway and had the firewalling/ipmasq set up fine before.

Anyone ever seen this message?

[sarah31]

:eek: I never heard of this my self, but I hope your ethernet card doesn't get pregnant or a nasty STD! :)

[sarah31]

5.04Q: What means "promiscuous mode"?
A: Promiscuous mode is a condition where the network interface controller will pass all frames, regardless of destination address, up to the higher level network layers. Normally the network controller will only pass up frames that have that device's destination address. However, when put in promiscuous mode, all frames are passed on up the network stack regardless of destination address. Promiscuous mode is usually used by network monitoring tools and transparent bridges (and, frequently, by network crackers trying to snatch passwords, or other data they're normally not able to see, off the wire).
http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci518283,00.html

There are lots of hits on google for this BTW. These were just a few. Hope this helps somewhat.

[ 26 January 2002: Message edited by: sarah31 ]

[z0mbix]

have you got snort installed?

[X_console]

Unless you've installed some kind of packet monitoring software, you probably want promiscous off. Otherwise, it could be a sign that someone is sniffing your computer. In any case, check the log files in /var/log and see if you can determine what the problem is.

[Syngin]

Originally posted by X_console:
<STRONG>Unless you've installed some kind of packet monitoring software, you probably want promiscous off. Otherwise, it could be a sign that someone is sniffing your computer. In any case, check the log files in /var/log and see if you can determine what the problem is.</STRONG>

How would I go about forcing it not to engage promiscuous mode? Its been ok for 4 hours now but I'm just waiting for the shoe to fall.

[X_console]

Well the default behaviour is for it to not go into promiscous mode at all. If it is, then some program is making it do so. To force it to not go, find out what's making it do it and then stop it. Check your crontab and see if there's anything in there that's causing it to go promiscous.