[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Promiscuous mode for ethernet device


iirc promiscuous mode means to listen to all traffic on the network
as opposed to only traffic addressed to the mac address of your ethernet
card.   this is real useful for passively sniffing packets on your
network when you don't want to / can't run it on one of the machines
in question.  

as for why you were going in and out of that mode -- were you using
any packet filtering/processing application like tcpdump or dsniff?
iptables might do that as well, but i can't say off the top of my head
for sure.

anyway i wouldn't be too concerned security-wise.  there used to be a
bug in tcpdump (or libpcap, i forget which) that you could exploit if
a device were in promiscuous mode, though it's been long fixed.


On Tue, Dec 10, 2002 at 06:56:01PM +0100, A. Loonstra wrote:
> After succesfully upgrading a debian potato server to woody I was left 
> with an upgraded system which only needed a reboot to get kernel 2.4.18 
> running. But since everything was done remotely I waited until I was 
> standing in front of the machine to do the reboot. I'm glad I did!!!
> When shutting down the system I was confronted with 2 final messages on 
> the console which said something like
> eth0 going into promiscuous mode following something like
> eth0 left promiscuous mode....
> What the F^%&*( what does this mean???  It was quite useless to put the 
> machine into promiscuous mode since it was shutting down.. Or was the 
> DHCPD daemon doing something?
> Does anyone knows what it was doing. It seems unlogical that the machine 
> was hacked or so.
> Arnaud.
> -- 
> To UNSUBSCRIBE, email to debian-user-request@lists.debian.org 
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Attachment: pgpZk0hKW7QQ1.pgp
Description: PGP signature

Reply to: