Re: Interface promiscuity obscurity in Linux

[Rasmus Bøg Hansen <moffe () amagerkollegiet dk>]

On Thu, 25 Jul 2002, Ricardo Branco wrote:

> This affects Linux 2.2 and 2.4
>
> Using libpcap to put the interface in promiscuous mode, will cause that
> ifconfig(8) doesn't show it!
>
> libpcap uses setsockopt(..., SOL_PACKET, PACKET_ADD_MEMBERSHIP, ...) with
> PACKET_MR_PROMISC to set the interface in promiscuous mode.

I can confirm that with 2.4.19-rc3. When using tcpdump (with libpcap),
ifconfig does not report, that the interface is in promiscous mode:

root@grignard:~# tcpdump -n -i eth0 > /dev/null &
[1] 20101
tcpdump: listening on eth0
root@grignard:~# /sbin/ifconfig
eth0      Link encap:Ethernet  HWaddr 00:90:27:A6:63:DC
          inet addr:172.16.0.130  Bcast:172.31.255.255  Mask:255.240.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1848637 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2654247 errors:0 dropped:0 overruns:0 carrier:0
          collisions:34909 txqueuelen:100
          RX bytes:231541983 (220.8 MiB)  TX bytes:3666205284 (3.4 GiB)
          Interrupt:10 Base address:0xb000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:101208 errors:0 dropped:0 overruns:0 frame:0
          TX packets:101208 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:32332341 (30.8 MiB)  TX bytes:32332341 (30.8 MiB)

root@grignard:~# uname -a
Linux grignard 2.4.19-rc3 #1 lør jul 20 04:06:23 CEST 2002 i686 unknown
root@grignard:~#

tcpdump does use libpcap here, and it does set eth0 in promiscous mode:

moffe@grignard:~# ldd /usr/sbin/tcpdump
        libpcap.so.0 => /usr/lib/libpcap.so.0 (0x4001e000)
        libnsl.so.1 => /lib/libnsl.so.1 (0x40039000)
        libc.so.6 => /lib/libc.so.6 (0x4004e000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
moffe@grignard:/tmp# dpkg -l libpcap0 tcpdump net-tools
Ønsket=Ukendt/Installér/Fjern/Udrens/Tilbagehold
| Status=Ikke/Installeret/Opsæt.-files/Upakket/Opsætn.-fejl/Halvt-inst.
|/ Fjl?=(ingen)/Tilbageholdt/Geninst.-krævet/X=begge-dele (Status,Fjl:
versaler=slemt)
||/ Navn           Version        Beskrivelse
+++-==============-==============-============================================
ii  libpcap0       0.6.2-2        System interface for user-level packet captu
ii  tcpdump        3.6.2-2.0.1    A powerful tool for network monitoring and d
ii  net-tools      1.60-4         The NET-3 networking toolkit
moffe@grignard:~# dmesg
[...]
device eth0 entered promiscuous mode
device eth0 left promiscuous mode

/Rasmus

-- 
-- [ Rasmus "Møffe" Bøg Hansen ] ---------------------------------------
Don't you hate yourself in the morning?
- Sleep till noon!
----------------------------------[ moffe at amagerkollegiet dot dk ] --